PHP2Shell Affected Products: Firewalls, NAS, Panels and Apps
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a bug in PHP itself, so it reaches every product that runs PHP. This page collects what vendors said on October 21, 2026: which firewalls, load balancers, NAS devices, control panels and web apps are affected, and what to do for each.
Short answer: Palo Alto PAN-OS and F5 BIG-IP are affected with no fix yet. FortiGate and Sophos are not affected. Moodle, MediaWiki, WordPress, Drupal and other PHP apps are affected through the PHP they run on, and the fix is a PHP update, not an app update.
Two kinds of affected product
Appliances such as firewalls, load balancers and NAS devices bundle their own PHP, often in the admin web interface. Only the vendor can fix them, so a vendor statement matters. Until a fix ships, keep the admin interface off the internet.
Web applications such as Moodle or WordPress use whatever PHP the server has. They need no app patch: update PHP and they are covered.
Firewalls and network appliances
| Product | Status | What to do |
|---|---|---|
| Palo Alto Networks PAN-OS (12.2, 12.1, 11.2, 11.1, 10.2) and Panorama | Affected, fixed versions not yet announced. Vendor rates it High (CVSS 4.0 8.7) and knows of no attacks on its products. | Restrict the management interface to trusted IPs or a jump host |
| Palo Alto Cloud NGFW, Prisma Access, GlobalProtect app, Cortex | Not affected | None |
| F5 BIG-IP 17.x and 21.x | Affected, no fix yet (K000163821) | Limit access to the Configuration utility |
| Fortinet FortiGate (FortiOS), FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC | Not affected (FG-IR-26-186) | None |
| Fortinet FortiADC, FortiClient EMS, FortiSIEM, FortiSOAR, FortiDDoS, FortiMonitor and others | Under investigation | Watch the Fortinet advisory |
| Sophos (all products, including UTM) | Not affected; its old hosted MyUTM portal was taken offline to update | None |
| Cisco | Under investigation; no product known to be affected yet. About 30 products listed for review, including ISE, Catalyst Center, SD-WAN Manager and Expressway. | Watch advisory cisco-sa-php-october26-Jj384Daq |
| Check Point | No statement on its own products; published IPS protection CPAI-2026-15172 | Enable the protection if you use Check Point IPS |
| Citrix NetScaler, Juniper J-Web, Ivanti, SonicWall, VMware | No statement found | Keep admin interfaces off the internet |
| pfSense, OPNsense, DrayTek, ZyXEL, D-Link, TP-Link, Netgear | No statement found; their web interfaces use PHP | Do not expose the web interface to the internet |
Synology and QNAP NAS
Neither Synology nor QNAP had published an advisory when we checked. On Synology, the PHP packages used by Web Station are the exposed part; a third-party guide reported no patched package as of October 21 and 22. On QNAP, the QTS web server uses built-in PHP that only a firmware update can fix. Until the vendors ship updates, do not expose NAS web interfaces or PHP sites hosted on the NAS to the internet, and use a VPN for remote access.
Hosting control panels
| Panel | Status | What to do |
|---|---|---|
| cPanel | Fixed: EasyApache 4 version 25.91 for hosted PHP, with backports for 7.4, 8.0 and 8.1; cPanel & WHM 136.0.50 for the panel's own PHP | Update EasyApache and cPanel & WHM |
| Plesk | Affected: all PHP it ships, including the panel's own engine. Hosted PHP rebuilt; panel hotfixes 18.0.80#11 and 18.0.81#4 were pending. | Update PHP handlers now; install the panel hotfix when it ships |
| DirectAdmin | Fixed in CustomBuild | Rebuild PHP |
| aaPanel | Fixed builds of PHP 8.2 to 8.5 in the App Store | Update each PHP version |
| HestiaCP | Hosted PHP fixed through system packages; the panel's own hestia-php still being fixed | Update packages; watch for a hestia-php update |
Commands for each panel are on the PHP2Shell patch page.
Moodle, MediaWiki, WordPress and other PHP apps
| App | What the project said |
|---|---|
| Moodle | Moodle HQ took its own public sites offline as a precaution and told self-hosted sites to update PHP immediately. No Moodle release is needed. |
| MediaWiki | Wikimedia told MediaWiki operators to update PHP immediately. No MediaWiki release is needed. |
| WordPress | Self-hosted sites need a PHP update; updating WordPress or plugins does not help. WordPress.com, VIP and Pressable are protected. See PHP2Shell and WordPress. |
| Drupal | Security notice PSA-2026-10-20: updating PHP is the only complete mitigation. |
| Joomla, Magento / Adobe Commerce, phpMyAdmin, GLPI, Zabbix frontend | No project statement found. Researchers showed Joomla, Magento and phpMyAdmin can be attacked through an unpatched PHP. Update PHP. |
| Nextcloud | All-in-One version 14.4.1 ships the patched PHP; other installs update PHP on the server. |
| Roundcube | Official Docker images were rebuilt on October 21; pull the new images. |
| Laravel, Symfony, WHMCS | Affected through PHP; update PHP. |
If an app runs in Docker, rebuild or pull its image: the PHP inside the container does not update with the host.
Cloud platforms
Google App Engine Standard (PHP 8.2 and later) was fixed automatically. Heroku is fixed after a redeploy. AWS says its own services are not affected, but PHP you run on EC2, Lightsail or Elastic Beanstalk needs updating; see PHP2Shell on AWS. If you use Cloudflare, see Cloudflare and PHP2Shell.
Products not listed here
The Dutch NCSC keeps a public list of more than 670 PHP-based products on GitHub (NCSC-NL/php2shell), marked under investigation, vulnerable, fixed or not vulnerable. For most apps, vulnerable there means vulnerable when run on an unpatched PHP. To find PHP across your own servers, see the PHP2Shell scanner guide.
Vendor statements checked on October 21, 2026. Fixed versions for PAN-OS, BIG-IP and the Fortinet products under investigation were still to come.
PHP2Shell affected products FAQ
Is FortiGate affected by PHP2Shell?
No. Fortinet advisory FG-IR-26-186 says FortiOS (FortiGate), FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC are not affected. FortiADC, FortiClient EMS, FortiSIEM, FortiSOAR, FortiDDoS and some others were still under investigation on October 21, 2026.
Is Palo Alto PAN-OS affected by PHP2Shell?
Yes. Palo Alto Networks lists all versions of PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2, and Panorama, as affected, with fixed versions still to be announced. It advises restricting the management interface to trusted IP addresses. Cloud NGFW, Prisma Access and GlobalProtect are not affected.
Is F5 BIG-IP affected by PHP2Shell?
F5 article K000163821 lists BIG-IP 17.x and 21.x as affected with no fix yet. Until a hotfix ships, keep the Configuration utility (TMUI) off the internet and limit it to trusted addresses.
Is Synology affected by PHP2Shell?
Synology had not published an advisory when we checked. The exposed parts are the PHP packages used by Web Station; if you host PHP sites on a Synology NAS, keep them off the internet until Synology ships updated packages.
Do I need to update Moodle, MediaWiki or WordPress?
No app update fixes PHP2Shell. These apps are affected only through the PHP they run on, so update PHP on the server. Moodle, Drupal and Wikimedia all told operators to update PHP.