Patching your web server won't stop PHP2Shell in your firewall

Beyond the web server

PHP2Shell reaches well past web servers. The two critical remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, live inside any PHP-enabled interface, including the management consoles of enterprise firewalls, NAS storage devices and network appliances that embed PHP to serve web-based administration panels.^[1] Disclosed by the PHP Foundation on 21 October 2026, the flaws stem from improper handling of out-of-memory errors and stale global memory state, allowing unauthenticated attackers to execute arbitrary code in default PHP configurations.

A patch applied to a central web server does nothing for an organisation's firewall management console or NAS admin panel running the same vulnerable PHP engine. Security teams must map every appliance and container image separately, rather than updating only their public-facing servers.

Vendor by vendor: what each company has said

Palo Alto Networks

Every PAN-OS version from 10.2 through 12.2, as well as Panorama, is confirmed affected by PHP2Shell, and Palo Alto Networks had no fixed PAN-OS release available as of 21 October 2026.^[1] Palo Alto Networks recommends restricting management interface access and enabling threat prevention signatures in the interim. The company said organisations can reduce the risk of exploitation by "restricting access to a jump box that is the only system allowed to access the management interface."^[1]

Cisco

Cisco PSIRT published and updated its advisory on 21 and 22 October 2026, confirming it is investigating whether its products and cloud services are impacted.^[2] Products under investigation include Identity Services Engine, Catalyst Center, Meraki, Webex, Splunk and Slido. The advisory says no Cisco product is yet known to be affected. Cisco PSIRT said: "There are no workarounds that address these vulnerabilities."^[2]

Fortinet

Fortinet released three FortiGuard signatures for FortiWeb and FortiAppSec Cloud on 22 October 2026 to block exploitation attempts for both CVE-2026-109618 and CVE-2026-109619. Signature 090502651 is approved by default; FortiWeb administrators must review and approve the other two, 090502654 and 090502648.^[3] Fortinet's advisory says 12 products, including FortiOS, are not affected, while FortiADC, FortiSIEM and FortiSOAR remain under investigation.^[7]

QNAP

QNAP's advisory QSA-26-18, published 22 October 2026, lists a wide range of affected firmware versions: QTS 6.1.0, QTS 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, plus Note Station 3, QVR Surveillance on ARM32 models and TVR OS.^[4] Fixes are in progress. QNAP PSIRT said: "Until fixed versions are available, the most effective protection is to keep the device off the internet."^[4]

Synology

Synology published advisory Synology-SA-26:14 on 22 October 2026, confirming PHP2Shell vulnerabilities in its PHP 7.3 to 8.4 packages (PHP 7.3 is end of life and gets no fix), as well as Synology Calendar and Mail Station.^[5] Updated package versions with fixes are specified in the advisory. Synology PSIRT said that "the built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low."^[5]

Docker

Docker said on 22 October 2026 that its Official Images and Hardened Images have been updated to the fixed PHP releases, and that "Updating is the only complete mitigation path." Containers bundle their own PHP runtime, so images built on older PHP must be pulled again or rebuilt.^[6] A host-level patch alone will not remediate a containerised PHP environment.

Practical checklist for Australian businesses

PHP2Shell's scope means a standard patching cycle falls short. Security teams need to audit every appliance, NAS device and container image for an embedded PHP runtime, alongside the public web servers.

Palo Alto Networks customers should restrict management interface access to a dedicated jump box while fixed PAN-OS releases remain unavailable.^[1] Cisco customers should monitor the vendor's advisory page directly, given that no workarounds exist for the 18 products and 13 cloud services under investigation.^[2] QNAP NAS devices should be removed from direct internet exposure until firmware fixes are released.^[4] Synology users should apply the updated package versions listed in advisory Synology-SA-26:14.^[5]

Organisations running containerised workloads must rebuild PHP-based Docker images even where the underlying host has been patched, as each container carries its own PHP runtime.^[6] The Australian Cyber Security Centre can be contacted on 1300 CYBER1 to report incidents or receive further guidance. Bushletter's live coverage of PHP2Shell has the full patching checklist and updates.