Is Your Firewall, VPN or NAS Affected by PHP2Shell? How to Check Appliances and Products That Bundle PHP How to check if firewalls, VPN gateways, NAS and cloud services that bundle PHP are hit by PHP2Shell: vendor advisories, statuses, fixes and version checks.
Is Your Firewall, VPN or NAS Affected by PHP2Shell? How to Check Appliances and Products That Bundle PHP
If you've already updated PHP on your web servers (the flaws are explained here ), there is still PHP nobody on the team installed: the copies inside firewalls, VPN gateways, load balancers, NAS devices, security consoles and some cloud services. CISA's alert puts it plainly: PHP is often a component of other software, and its prevalence may not be directly observable.
Short answer: for appliances and packaged products, don't try to work out which PHP version runs inside. List the vendors and products you run, open each vendor's own PHP2Shell advisory, read the status correctly (affected, not affected, or still under investigation), apply the fix the vendor publishes, and confirm the product version matches the vendor's fixed version. In the meantime, restrict access to management interfaces and follow the vendor's guidance for every affected surface.
In Thailand, ThaiCERT published a PHP2Shell advisory on 22 October 2026. It notes that a proof of concept is public and that PHP has released fixed versions, and its list of what to check includes packaged products that contain PHP . It doesn't say whether attacks have been seen in Thailand.
Step 1: List the vendors and products you run
php.net says every PHP installation serving web requests is affected, so start with anything that has a login page or a portal: firewalls and VPN gateways (including captive portals), load balancers, NAS devices with the apps and containers added to them, on-premises security management consoles, and cloud services where you run your own PHP code.
For each one, record the vendor, model, current software version (firmware, OS, hotfix or package), the features enabled, whether it's reachable from the internet, and who applies updates.
Record the enabled features too, because several vendors decide "affected" by feature:
Product Affected, per the vendor, when Palo Alto PAN-OS Only the management web interface (web UI and XML API), plus dataplane interfaces with a management profile attached. The GlobalProtect portal, gateway and Clientless VPN are not impacted. Check Point Gateways using Mobile Access Portal, Remote Access VPN with SSL Network Extender or SAML, or the Identity Awareness Captive Portal Netgate pfSense The GUI or Captive Portal is exposed to attackers. By default the GUI is LAN-only and Captive Portal is off. F5 BIG-IP The APM data plane (Access profile) and the Configuration utility
If you're evaluating a connected inventory workflow for this job, compare the plans on the pricing page and have your partner confirm the deployment scope before you decide.
Step 2: Read each vendor's own advisory, not a roundup
Multi-vendor roundups go stale fast. SOCRadar's list, updated 23 October, still had Cisco Catalyst Center and WAN Automation Engine under investigation, while Cisco's own advisory at 22:39 GMT the same day listed both as not vulnerable. The same roundup still showed Fortinet's FortiADC Manager and FortiDDoS-F as under investigation after Fortinet had listed them as not impacted. Cisco's advisory itself warns that copies or summaries may lack important information or contain errors.
The NCSC-NL list on GitHub is a useful index for finding vendor pages, but it isn't proof. On 25 October it had about 750 product rows by our count, most still marked "Investigation".
This table shows each status as we checked it on the vendor's own site on 25 October 2026. "As of" is the date the vendor last updated that page.
Vendor / product Status Fixed version or vendor action As of Palo Alto Networks PAN-OS, PanoramaAffected (management interface) Hotfixes per branch, ETAs 27–30 Oct; some ETAs removed on 25 Oct, so check whether those are now listed as available 25 Oct Siemens RUGGEDCOM APE1808 (PAN-OS)Affected Contact Siemens support; apply Palo Alto's workarounds 23 Oct Cisco Affected: Expressway, URWB, Duo Access Gateway / Under investigation: several, e.g. ISE Portal Builder / Not vulnerable: e.g. ASA, Secure Firewall Threat Defense, ISE, Meraki MX Expressway 15.5.21 (date TBD), URWB 27.1.1 (Feb 2027), Duo Access Gateway 3.2.0 23 Oct Fortinet Not impacted: FortiOS, FortiWeb, FortiADC and many more / Under investigation: FortiDDoS, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS No product listed as affected 23 Oct Sophos No products affected (the Sophos-hosted MyUTM portal was taken offline) No action on the products 22 Oct Check Point Affected, only the features in step 1 Hotfix for R82.10, R82, R81.20 (reboot required); R82.20 "Coming soon" 23 Oct F5 BIG-IPAffected: APM, Configuration utility / Not vulnerable: BIG-IQ, F5OS, NGINX 21.1.0.4, 17.5.1.11, 17.1.3.7 24 Oct Citrix NetScaler ADC, GatewayImpacted No fixed version listed; points to a Citrix community blog for mitigation 22 Oct Netgate pfSenseAffected when the GUI or Captive Portal is exposed PHP 8.5.12 packages (Plus 26.07, 26.03.1, CE 2.9.0) and 8.3.36 (CE 2.8.1) 21 Oct OPNsense Hotfix released Business 26.4.2p4, Community 26.1.11 and 26.7.7 23 Oct Trend Micro Impacted: Apex Central, Apex One (on-premise server), Trend Micro Web Security, Deep Discovery Inspector, Analyzer and Email Inspector Mitigation in development; critical patch ETA 30 Oct for the three Deep Discovery products Page updated 24 Oct; status as of 23 Oct QNAP OS fixed; some apps still "Fixing" QTS 6.1.0.3656 and 5.2.11.3661; QuTS hero h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661; QuTScloud c5.2.9.3661 (all build 20261023) 24 Oct Synology Resolved for the affected packages PHP package versions as listed, e.g. 8.4.27-0051 or above; no fix for PHP 7.3 22 Oct AWS AWS services not impacted PHP you run yourself is yours to update, e.g. on Lambda and Lightsail; EMR clusters with Ganglia on some releases are affected 23 Oct Azure App Service Built-in Linux images updated on the Latest and Standard channels; Extended gets the fix last Custom containers must be rebuilt by you; built-in PHP on App Service for Windows gets no patch 21 Oct
This table will change, because several rows are still waiting for hotfixes or still under investigation. The vendor's page is always the source of truth, so open it again when you decide. If your product isn't here, go straight to that vendor's PSIRT page.
Step 3: Read the status correctly
Keep these three apart:
Not affected (Not impacted): the vendor checked and confirms the product isn't affected.Affected (Impacted, Vulnerable): find the fixed version, or follow the vendor's workaround if there isn't one yet.Under investigation : the vendor doesn't know yet. It doesn't count as "not affected". See step 6.
Common misreadings:
Vendors use different rules. Cisco states that a product not listed in its advisory is not affected. Don't carry that rule over to other vendors: where a vendor doesn't say so, a missing product means "unknown".Match the fixed version to your branch. F5 lists 17.1.0 to 17.1.3 as affected and 17.1.3.7 as the fixed release for that branch; check F5's branch table for other builds. A row with only an ETA or "TBD", like Cisco's Expressway 15.5.21 (TBD) or Trend Micro's Deep Discovery patch (ETA 30 Oct), meant there was nothing to install when we checked on 25 October."Resolved" doesn't mean every component is fixed. Synology marked its advisory Resolved because the affected packages have fixes. It says DSM's internal PHP has no exposed attack surface and scheduled a patch in a later DSM release so vulnerability scan results line up. Until then, scanners may still flag it.Vendor updates may exclude added containers and third-party apps. QNAP says PHP in containers on Container Station, or in third-party apps, is not covered by QNAP updates. What you added, you patch.
Step 4: Apply the vendor's fix; never patch an appliance's PHP yourself
The PHP inside an appliance is built and tested by the vendor as part of the system. The vendor's fix may arrive as firmware, a hotfix or a package. Examples from the vendors' pages:
Check Point Netgate pfSense : the PHP packages can't be updated from the GUI; it has to be done from an SSH or console shell. Netgate's recommended Method 1 updates all packages, reinstalls the WireGuard package last so it uses the correct PHP version, and reboots. Plan it as a maintenance window and follow Netgate's page; doing it over a WireGuard connection is likely to interrupt that connection.Synology F5 : if you can't reach a fixed version yet, F5 provides an interim procedure : a php.ini drop-in and a restart of the affected services, including the APM service on APM systems. Follow F5's page in full; F5 warns that it won't survive a TMOS upgrade.
Our recommendation is not to replace the embedded PHP yourself. Advisories list fixed product builds, such as BIG-IP 17.1.3.7; a PHP you build and drop in may carry a fixed upstream version, but it doesn't show that the appliance matches the build the vendor documents as fixed. If a partner or MSP manages the device, ask for the post-update version in writing.
Step 5: Confirm the fixed version afterwards
Read the version from the device's console or CLI , as the vendor documents it, and compare it with the advisory's fixed version. Compare the firmware, OS, hotfix or package version the vendor names. The PHP version inside is only a valid check where the vendor gives it, as Netgate and OPNsense do.Do every restart or reboot the vendor requires. The Check Point hotfix needs a reboot; OPNsense says to restart the captive portal service after updating.On an appliance, php -v is not evidence. ThaiCERT's advisory suggests checking versions with php -v, which works on servers you run. But it reports the command-line PHP, which can differ from the PHP serving web pages (why that matters ). On an appliance, use the product version from point 1.Know what each scanner does. OpenAI's php2shell-checker, in URL mode, reads headers only and is passive, so it can't see backported fixes. ProjectDiscovery's Nuclei template and Assetnote's php2shell-scanner send large multipart probes; both are intrusive, and the Nuclei template can crash PHP workers. Don't point them at a production firewall or NAS management interface.
Step 6: What to do while a vendor is still investigating
Vendors' interim advice covers two kinds of surface. For management interfaces, reduce who can reach them:
Palo Alto : allow only trusted internal IP addresses, or a jump box, to reach the management interface.QNAP : take the NAS off the internet, disable UPnP port forwarding on the router and in myQNAPcloud, use a VPN, and restrict the management ports (8080 and 443 by default).Trend Micro : restrict access to impacted management servers and consoles to trusted IP addresses.Netgate : check that filter rules keep the GUI off untrusted networks, and reach the GUI over a VPN.F5 : restrict access to the Configuration utility.
The second kind is a portal or service your users reach that is itself affected, such as F5's APM data plane, pfSense's Captive Portal, or the Check Point portals and VPN listed in step 1. Restricting management access does nothing for these. Follow the vendor's guidance for that surface directly: Netgate tells Captive Portal users to update PHP as soon as possible, and where a vendor says to take an affected service offline, do so.
Products still under investigation usually come with no specific guidance. Apply the same approach while you wait: if the management interface faces the internet, close it or limit it to trusted networks, and recheck the advisory until the status changes. NAS apps you don't use can be turned off for now, in line with CISA's advice to take PHP systems that can't be updated offline until they're patched.
For PHP you run yourself in the cloud, such as on Lambda, Lightsail or a custom container on Azure, see updating PHP on your own server and the cPanel, Plesk and DirectAdmin guide .
What this article doesn't cover
Whether a device was already compromised. If an affected management interface or portal was internet-facing while unpatched, continue with log hunting and incident response .
To make step 1 repeatable next time, zcrCTEM 's CAASM merges hosts, devices and cloud resources from your connected sources into one inventory, and its EASM raises open-port findings from discovery that starts at your seed domains. It doesn't replace the vendor's fix.
Related reading
What PHP2Shell is · Check the PHP version each site runs · How far a WAF helps · Hunting in the logs · Still on PHP 7.4, 8.0 or 8.1
Get in touch
Want a second opinion on where your device and product list should start, and what to check first? Talk to our team — the consultation is free. zcr supplies the software; hands-on patching, system checks and incident response are delivered through partners.
Sources
All pages read on 25 October 2026.
CISA — Critical Vulnerabilities in PHP Require Immediate Patching — PHP as a component of other software; taking PHP systems that can't be updated offlineThaiCERT — PHP2Shell advisory (22 Oct 2026, Thai) — public PoC, fixed releases, packaged products containing PHP in the list to check, the php -v suggestionPHP.net — 2026 news archive — every PHP installation serving web requests is affected; 9.2 scorePalo Alto Networks — CVE-2026-109618 and Siemens SSA-566512 Cisco — Vulnerabilities in PHP Affecting Cisco Products: October 2026 Fortinet FG-IR-26-186 and Sophos — PHP2Shell advisory Check Point sk1000302 and F5 K000163821 Citrix CTX697263 Netgate — Critical PHP Security Update and OPNsense — PHP2Shell hotfix Trend Micro KA-0024802 QNAP QSA-26-18 , Synology-SA-26:14 and Synology Statement on PHP2Shell AWS Security Bulletin 2026-143-AWS and Azure App Service — PHP critical security release NCSC-NL — php2shell — product and vendor indexSOCRadar — PHP2Shell — example of an out-of-date list (updated 23 Oct)OpenAI php2shell-checker , ProjectDiscovery nuclei-templates CVE-2026-109618 and Assetnote php2shell-scanner — which are passive and which are intrusive Products | Pricing | Resources | Insights | Contact 