PHP2Shell in Appliances: Firewalls, NAS and Other Devices That Run PHP

As of 23 October 2026, several makers of firewalls, storage devices and network equipment have confirmed that some of their products embed an affected version of PHP, while others have shipped fixes or confirmed they are not affected. Palo Alto Networks, the most-watched case, says it "is not aware of any malicious exploitation of this issue against our products," and its PAN-OS hotfixes are due between 26 and 30 October.

The direct answer: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in PHP, and PHP often runs inside the web-based admin screens of appliances. You cannot patch that PHP yourself. The fix must come from the device vendor as a firmware or software update. Until it arrives, keep the device's management interface off the public internet.

The best public map of affected products is the inventory kept by NCSC-NL, the Dutch national cyber security centre. Below: how to read it and what to do with your devices. For background, read what PHP2Shell is and who it affects.

Why Appliances Run PHP at All

Some devices you manage in a browser, such as firewalls, VPN gateways, storage boxes and building controllers, serve that admin page with PHP. NCSC-NL: "PHP is also embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly."

That is the key difference from a website: on an appliance, PHP is sealed inside the vendor's firmware. Installing PHP packages on the device, editing its internals or running a community script is not a supported fix and does not replace the vendor's update. NCSC-NL's advice is to "apply vendor updates as soon as they become available."

What the NCSC-NL List Shows

The NCSC-NL php2shell software list is published on GitHub and is updated as vendors respond. Its status line read "Software list last status update: 23 October 2026 14:46 CEST" when we counted it. Each product gets a status for each CVE.

Read the "Vulnerable" count with care. For most applications, the note says the product is "Affected when deployed on an affected web-serving PHP runtime." That is an inference from "it runs on PHP," not a vendor finding and not a report of attacks.

The list carries its own warnings. Entries "should still be treated as investigation leads until they are backed by an upstream or vendor source," and "No guarantees are made regarding the completeness or accuracy of this inventory." A product missing from the list is not proof that it is safe.

Appliance Entries on the List

These are appliance and security-product entries as NCSC-NL listed them on 23 October 2026. Statuses change daily, so confirm each one on the vendor's own advisory before acting.

Details in the rows matter. The Citrix row scopes the exposure to NetScaler management GUIs, and the Cisco Expressway rows say the listed 15.5.21 fix "has a TBD availability date." Cisco keeps its own running list in its PHP advisory.

NAS and Small-Office Devices

Network-attached storage boxes are the appliances a small office is most likely to own. Several are on the list:

• QNAP: listed as Vulnerable across QTS, QuTS hero, QuTScloud and several apps, with version ranges such as "QTS 6.1.0; QTS 5.2.11 and earlier."
• Synology: listed as Fix for its PHP 7.4 to 8.4 packages and Web Station (advisory Synology-SA-26:14). The archived PHP 7.3 package is listed as Vulnerable.
• Unraid: listed as Fix in Unraid OS 7.3.4, which ships PHP 8.4.27.
• TerraMaster: its optional PHP web hosting on TOS6 is under Investigation.

If you own one, check its admin panel for a system or app update and install it. If its admin page is reachable from the internet, for example through port forwarding, turn that off until you have updated. Our PHP2Shell guide for small businesses covers the rest of a small-office checklist.

Palo Alto Networks and Siemens

Palo Alto's advisory for CVE-2026-109618 and CVE-2026-109619 was published on 21 October and updated on 23 October 2026. Its key points:

• Severity. "Severity 8.7 · HIGH," "Urgency MODERATE." Palo Alto scores the impact on its products as availability only: confidentiality and integrity are rated NONE, availability HIGH. That is Palo Alto's product-specific rating, lower than PHP's own 9.2, which the page also shows as the "Vendor CVSS-B."
• What is affected. PAN-OS and Panorama 10.2, 11.1, 11.2, 12.1 and 12.2, with hotfixes due between 26 and 30 October (for example ">= 12.2.4-h1 (ETA: 10/28)"). Palo Alto says the issue "strictly affects the management web interface, which includes the HTTPS web UI and XML API service," and a dataplane interface only "if a management profile is attached to it."
• What is not. "GlobalProtect portal, gateway and Clientless VPN are not impacted," and neither is the captive portal.
• WF-500 change. Earlier on 23 October the WildFire WF-500 and WF-500-B rows showed every version affected, with a fix "ETA: TBD." By our later reading the same day, they show no affected versions and all versions unaffected. Re-check the advisory, since it may change again.
• Cloud services. Palo Alto says Cortex XCORE (SaaS) and WildFire Cloud were "previously impacted" and received remediation patches on 21 and 22 October.
• Risk reduction. "The risk is highest on PAN-OS when you allow access to the management interface from external IP addresses on the internet." Palo Alto says the risk is "minimized by restricting access to the management interface to only trusted internal IP addresses." Threat Prevention customers can enable Threat IDs 543004, 97622, 97623, 97624 and 97625, with the configuration steps in the advisory.

Siemens published SSA-566512 (version 1.0, 23 October 2026) for its RUGGEDCOM APE1808, an industrial device that runs PAN-OS. It lists "All versions with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All)" as affected and says to "Contact customer support to receive patch and update information." Siemens' header shows "CVSS v3.1 Base Score: 9.8 CVSS v4.0 Base Score: 9.2." Those are the generic PHP scores, not Palo Alto's product rating. For PAN-OS-based devices, Palo Alto's 8.7 availability-only score is the product-specific one. Siemens was not on the NCSC-NL list as of its 14:46 CEST update, and NCSC-NL's PAN-OS row still read "fixed releases not yet announced" while Palo Alto's page already listed hotfix dates. The vendor page comes first.

What to Do With Your Devices

1. List every device with a web admin page, including virtual appliances.
2. Look each one up on the vendor's advisory page, then the NCSC-NL list. If the vendor has said nothing, ask support in writing.
3. Close management access from the internet. Restrict admin pages to trusted internal addresses or a VPN. Both Palo Alto and Siemens recommend restricting network access to device management.
4. Install the vendor's update as soon as it ships, using the vendor's documented process. Do not try to update PHP inside the device yourself.
5. Use the vendor's interim protections if it offers them, such as Palo Alto's Threat IDs, and follow its configuration notes.
6. Check the device's logs for unexpected admin logins or configuration changes since 17 October, the earliest date any vendor has reported an exploitation attempt against PHP. If anything looks wrong, follow your incident response plan.
7. Re-check often. Advisories are changing in both directions.

Public agencies: see our PHP2Shell guide for local government.

What This Does Not Mean

• "Vulnerable" does not mean "being attacked." NCSC-NL's list records product status, not attacks, and as of 23 October 2026 Palo Alto says it knows of no malicious exploitation against its products. Our exploitation status tracker covers the wider picture.
• "Vulnerable" does not always mean the same thing. For an app, it often means "runs on PHP." For an appliance, it usually means the vendor confirmed affected PHP, sometimes only in one admin component.
• Not listed does not mean not affected. NCSC-NL makes no promise of completeness. Ask the vendor.
• A website fix does not cover your devices. Patching PHP on your web server does nothing for PHP inside a firewall, and the reverse is also true. Our website security checklist covers the web side, and our was my site hacked guide covers web server checks.

Conclusion

PHP2Shell reaches beyond websites into the admin screens of firewalls, storage devices and other appliances. Read NCSC-NL's counts as a starting map, not a verdict: most "Vulnerable" rows mean "runs on PHP," while appliance rows usually point to a vendor advisory. Take the fix from the device vendor, keep management interfaces off the internet until it ships, and re-check the vendor's page, as Palo Alto's WF-500 change shows. If you want help building a device and website inventory, see our website security services. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions