ⓘ Jakub Zerdzicki / Pexels
PHP2Shell is not just a web hosting problem. PHP also runs NAS interfaces, firewalls, Nextcloud containers and older Pi-hole installs. QNAP is still working on a fix, OPNsense and pfSense are already patched, and Docker images are being rebuilt. Here is how to find PHP on your network and close the holes.
The PHP2Shell patches arrived on Wednesday evening, and many web hosts have already rolled them out. Home networks are harder to sort out. PHP also ships inside components people rarely think of as PHP apps, such as a NAS web interface, a firewall, a Nextcloud container or an old Pi-hole. According to the PHP project, the two flaws, CVE-2026-109618 and CVE-2026-109619, allow code execution without authentication, and both are rated 9.2 under CVSS 4.0. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix from the PHP project. Our news article on PHP2Shell covers the technical details. This guide covers where PHP runs on a home network and what to do about it now.
How serious it is
Security firm watchTowr has seen active exploitation attempts against both flaws since Wednesday but has not reported any successful compromises. In its warning from October 21, Germany's BSI said it knew of no confirmed exploitation yet. QNAP also says it has received no reports of attacks on its own devices. The risk comes from two facts. The flaws can be exploited before any login prompt appears, and many homelab services are exposed to the internet through port forwarding.
QNAP: Fix coming, take the NAS offline until then
QNAP published security advisory QSA-26-18 on October 22. Affected versions include QTS 6.1.0, QTS 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier, and QuTScloud c5.2.9 and earlier. Note Station 3, QNE, QVR Surveillance on ARM32 models and TVR OS are also affected. No fixed versions are out yet, and the status reads "Fixing." Download Station and the PHP Extensions will not get a fix at all because their support ended on September 30. QNAP recommends backing up your download tasks and uninstalling both.
Until the update arrives, QNAP wants the NAS off the internet. Turn off port forwarding on your router, disable UPnP on the router and under Auto Router Configuration in myQNAPcloud, and unpublish any services you do not need under Publish Services. For remote access, use a VPN such as QVPN or your router's VPN. In QuFirewall, limit the management ports 8080 and 443 to your local network. If you do not use the built-in web server, turn it off under Applications in the Control Panel. QNAP says its update does not cover PHP inside Container Station containers.
Synology: No advisory yet
As of Thursday, October 22, Synology had not published an advisory on PHP2Shell. Its most recent DSM advisory dates from September 18. If you run Web Station with PHP profiles, keep an eye on Package Center. Until a patched PHP package appears, the same rule applies as for QNAP, so no port forwarding and remote access only through a VPN. The Synology blog Marius Hosting also describes a PHP profile change that disables session.upload_progress.enabled. It targets one of the confirmed attack paths, but according to the PHP project it does not fully close the flaws.
OPNsense and pfSense are already patched
The web interfaces of OPNsense and pfSense run on PHP, and both projects moved quickly. On Wednesday evening, OPNsense released hotfix 26.7.7 for the Community Edition with PHP 8.5.12 and 26.4.2p3 for the Business Edition with PHP 8.3.36. If you use the captive portal, restart it after updating.
Netgate ships the new PHP for pfSense Plus 26.07 and 26.03.1 and for CE 2.9.0 with PHP 8.5.12, while CE 2.8.1 gets PHP 8.3.36. The update has to be installed over SSH or the console with pfSense-upgrade -c and pkg upgrade, and Netgate says the web interface cannot apply it. A reboot is recommended afterward. By default, the interface is only reachable from the LAN and the captive portal is off. If you kept both defaults, you can update when convenient. If you exposed the interface to the internet, update immediately.
Nextcloud, WordPress and other containers
Patched tags of the official PHP images, such as php:8.4.27-fpm, have been available on Docker Hub since Wednesday evening. Nextcloud All-in-One ships the new PHP with version 14.4.1, which came out the same evening. The official images for Nextcloud, WordPress, phpMyAdmin, Joomla and Matomo have also been rebuilt on Docker Hub since then. LinuxServer.io maintainers say all of their PHP containers are affected and that new builds will follow once Alpine ships the patched packages.
A new image alone does not protect you. A running container keeps using the old image until you recreate it, which with Docker Compose means docker compose pull followed by docker compose up -d. Running php -v through docker exec with the container name shows the PHP version that is actually running. If it reports 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a later release from the same branch, the container is patched.
Linux servers and Raspberry Pi
If PHP runs directly on the system, the fix comes through your distribution's package updates. Ubuntu has released patched packages but keeps the old version number because Canonical backports the fix. On Ubuntu 24.04, the patched package is php8.3 version 8.3.6-0ubuntu0.24.04.13. Debian ships the fixes through its security updates. Afterward, any service that uses PHP has to restart. According to Ubuntu, Apache with mod_php needs a full Apache restart, and PHP-FPM setups need the FPM service restarted.
Pi-hole users can relax. According to its developers, version 6 no longer needs lighttpd or PHP. If you still run Pi-hole 5, PHP is on your system, and this is a good reason to upgrade.
What php.ini workarounds actually do
Several php.ini settings are being shared online as mitigations. The PHP project itself lists memory_limit=-1 as the primary configuration mitigation for CVE-2026-109618 but stresses that it is not a complete fix. For CVE-2026-109619, the advisory says there is no generic configuration that fully protects you. At best, such changes buy time until you can update. The most effective protection is a homelab whose PHP services are not directly reachable from the internet and that you access remotely only through a VPN such as WireGuard or Tailscale.