In short: PHP runs not only on web servers but also in the web interfaces of NAS systems, firewalls and specialist devices, or in web server packages that you have installed on a NAS. Whether a device is affected by PHP2Shell can only be said by the vendor; the update comes via the firmware. Your job is to find these devices, take their web interfaces off the internet and follow the vendor announcements.
Why devices with a web interface belong in the PHP question
When PHP2Shell is discussed, most people think of the company website or the online shop. Yet PHP is also inside devices that nobody regards as a web server. They sit in the server room or the office, have a web interface for administration and often run for years without attention.
According to php.net, the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect PHP itself in the operating modes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. If a device's web interface uses one of these operating modes with a vulnerable version, the risk applies there just the same. The difference: you usually cannot update PHP on the device yourself.
There are solid reasons why such systems are forgotten. Often they were set up by a service provider who stopped looking after them long ago. Firmware updates do not run automatically but require a click that nobody makes. And some devices come with convenient remote access functions that make the web interface reachable from the internet without IT knowing. With a PHP vulnerability like PHP2Shell, this convenience turns into a risk.
PHP vulnerability on NAS and appliances: which systems come into question
Here we name types of devices, not statements about individual models. Whether a particular firmware is affected is stated exclusively in the vendor's announcements.
| Type of device | How PHP comes into play | Who updates |
|---|---|---|
| NAS with a web server package | You run your own PHP websites or apps on the NAS | Vendor supplies the PHP package, you apply it |
| Firewall and router distributions | Parts of the management interface are written in PHP | Vendor via firmware |
| Specialist devices with a web interface | e.g. telephone systems, time recording, building technology, where the vendor uses PHP | Vendor or specialist reseller |
| Virtual appliances | Preconfigured VMs with their own web interface | Vendor via update image |
| Containers on the NAS | PHP applications in Docker containers | You, via a new image |
Two documented examples: Synology allows PHP websites with selectable PHP profiles to be run in Web Station and has announced the end of support for PHP 7.3, 7.4 and 8.0 under DSM 7.3. Netgate's security announcements on pfSense describe PHP files and PHP error messages of the web interface. This only shows that PHP occurs there, not that these products are affected by PHP2Shell.
Inventory: how to find the forgotten systems
The most important step is a list. Many companies know exactly which websites they run, but not which devices have a web interface. What a permanent inventory looks like is described in the article Inventory of all websites and servers.
- Capture the network: Gather devices from the DHCP list, switch or firewall overview.
- Mark web interfaces: For each device, note whether it is managed via HTTP or HTTPS.
- Check exposures: List port forwardings and remote access services in the router. Every web interface that is reachable from the internet goes to the top.
- Assign vendors: Record model, firmware status and a link to the vendor's security announcements.
- Capture your own services: List web server packages and containers installed on NAS systems separately.
A first hint can be obtained with a harmless query of the headers. The command only retrieves the start page and changes nothing:
# Show the server headers of a web interface (address as an example)
curl -skI https://nas.intern.example/ | grep -iE "^(server|x-powered-by):"
If a PHP hint appears there, that is a clue. If it is missing, that proves nothing, because many devices deliberately suppress such details.
What you can do if you cannot patch yourself
With devices, the patch is up to the vendor. Reachability is up to you, and that is exactly where the biggest lever is. For PHP2Shell, the BSI (German Federal Office for Information Security) recommends temporarily taking web servers without an update off the network; for device management interfaces this applies all the more.
- Take it off the internet: Remove port forwardings to web interfaces and allow remote access only via VPN.
- Separate the management network: Make web interfaces reachable only from a separate network segment for administrators. Background in the article Shielding admin areas.
- Switch off what is unused: Deactivate web server packages or apps on the NAS that nobody needs any more.
- Follow firmware announcements: Enable update notifications and apply updates promptly once the vendor releases them.
- Replace old devices: Do not keep running devices without vendor support so that they are reachable from the internet, and plan their replacement.
If you run your own PHP websites on a NAS, the same applies to these websites as to any web server: check the version, update the package, restart the service. The basics of the vulnerability are explained in What is PHP2Shell?.
If a device stood openly on the network
If a web interface was reachable from the internet between 17 and 21 October and the device is affected, you should not just update it. Check whether accounts, shares or forwards were changed, secure available logs and change the credentials. A device that had an attacker on the network can serve as a stepping stone to other systems.
With firewalls and routers this is especially delicate because they see all traffic. When in doubt, a reset to factory settings with a clean reconfiguration is more reliable than searching for individual traces; logs and configuration should be backed up beforehand.
With a NAS, the question of the data is added. Contracts, personnel records or customer data are often stored there. If an attacker could access the device, you must clarify whether personal data may be affected; a notification duty under the GDPR may then apply. Discuss this early with your data protection officer; this is not legal advice.
How does PHP SOS help?
- Take stock: Together with you, we capture all systems with a web interface, including NAS, appliances and virtual machines.
- Check reachability: We check from outside which interfaces are reachable from the internet and suggest shielding. A deeper review is offered by the security audit with penetration test.
- Follow the vendor situation: We match vendor security announcements to your devices and plan updates.
- Clarify suspicion: If an affected device stood openly on the network, we secure logs and check for traces.
Frequently asked questions
Is my NAS affected by PHP2Shell?
Only the vendor can say so with authority for your model and your firmware. Check its security announcements and whether you run PHP websites on the NAS itself, for example via a web server package. Until this is clarified, the interface should not be reachable from the internet.
Can I update PHP on a NAS or a firewall myself?
As a rule, no. There, PHP is part of the firmware or of a vendor package. Updates come through the device's update function. Manual intervention in the firmware can endanger warranty and stability.
Is it enough to use the web interface only on the local network?
It lowers the risk considerably but does not eliminate it. A computer on the same network that is already compromised can still reach the interface. Better is a separate management network or access only via VPN.
How can I tell that a device uses PHP?
Sometimes the server header or the .php ending in addresses of the interface gives it away. If such hints are missing, that proves nothing. Vendor documentation and security announcements are reliable.