PHP2Shell: What the PHP Flaws Mean for a Home Automation Setup

On October 21 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws now being called PHP2Shell (PHP Foundation). PHP is the programming language behind a lot of web pages and device settings screens. Under the right conditions, both flaws let an unauthenticated attacker, meaning someone who never logs in, run code on a device that uses PHP to serve web pages. CISA, the US cybersecurity agency, is telling people to patch right away (CISA).

Who should care

Home Assistant is written in Python, and Hubitat apps and drivers are written in Groovy, so neither hub is part of this. Smart plugs, cameras and the like generally aren’t PHP web servers, but if you’re unsure about a device, check its maker’s security advisory page.

You should check if you run a NAS (a network storage box like Synology or QNAP), a pfSense or OPNsense firewall, Pi-hole 5, Nextcloud, or anything self-hosted in Docker that has a web page.

I don’t run anything that uses PHP, so this one doesn’t touch my setup.

Three steps

1. Figure out if you have one of the things in the table below.
2. Run its built-in update. On a NAS that’s the system update or package center. On a firewall it’s the vendor’s update steps.
3. Until it’s updated, turn off any remote access you set up for it.

“Exposed to the internet” means someone outside your house can reach the device’s web page directly. The usual way that happens is port forwarding, a rule in your router that sends outside traffic to a device inside. Open your router’s app or settings page and look for port forwarding, virtual servers, or UPnP. Taking a device off the internet means removing those rules, not unplugging it. I use Tailscale for remote access.

Where PHP shows up on a home network

Sources: Synology, QNAP, OPNsense, Netgate, Nextcloud AIO.

QNAP’s advisory lists fixed builds for QTS 5.2.11.3661 and 6.1.0.3656, QuTS hero h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661, and QuTScloud c5.2.9.3661. Note Station 3, QNE, QVR Surveillance on ARM32 models and TVR OS are still being fixed, and QuMagie 2.10.1 and earlier is listed as affected with no fix shown yet. Per Notebookcheck, Download Station and the PHP Extensions won’t get a fix because support ended September 30, and QNAP recommends uninstalling them. QNAP’s update also doesn’t cover PHP inside Container Station containers.

Netgate says the pfSense update can’t be applied from the web interface, so it has to be done from a command line. By default the pfSense web interface is only reachable from your local network and the captive portal is off. If you kept both defaults, Netgate says you can update when convenient. If you exposed the web interface to the internet, update now.

Pi-hole 6 no longer uses PHP or lighttpd, according to its developers (Pi-hole). Pi-hole 5 still uses PHP, which is a good reason to upgrade.

Nextcloud All-in-One 14.4.1 ships the updated PHP, per its GitHub release. Notebookcheck reports the official Nextcloud Docker images were rebuilt too.

Docker and Raspberry Pi

A container is a packaged app running in Docker. Pulling a new image isn’t enough. You have to recreate the container, for example docker compose pull then docker compose up -d. Running php -v inside the container shows what’s actually running. Notebookcheck reports LinuxServer.io’s PHP containers were still waiting on patched Alpine packages as of October 23.

If PHP runs directly on a Linux box or a Raspberry Pi, update through your distribution and restart Apache or PHP-FPM afterward. Ubuntu backports the fix without changing the PHP version number, so check the package version instead. On Ubuntu 24.04 the patched package is php8.3 version 8.3.6-0ubuntu0.24.04.13 (via Notebookcheck). Check your installed package version against Ubuntu’s security notice.

How bad it is

CISA had seen no successful exploitation when it published. QNAP reports scanning and blocked attempts against its own sites, and watchTowr reported exploitation attempts (per Notebookcheck). Proof-of-concept code is circulating (CERT-EU). CISA added a SIGMA detection rule to its alert on October 23.

PHP 8.1 and older get no official release. PHP published source-only backports for 7.4 to 8.1, and some vendors ship their own, but upgrading to a supported version is the fix (CERT-EU).

A third flaw, CVE-2026-115560, was disclosed October 23 and isn’t fixed by the October 21 releases. It only applies when an app switches the session serializer at runtime. Until a fix ships, PHP recommends setting session.upload_progress.enabled=0 (Canadian Centre for Cyber Security).

Technical details

The two flaws are CVE-2026-109618 and CVE-2026-109619. A CVE is the ID number given to a publicly known security flaw. Both are rated 9.2 out of 10 on the CVSS 4.0 severity scale. Synology lists them as 9.8 under the older CVSS 3.1.

CVE-2026-109618 is memory corruption when a request hits PHP’s memory limit at the wrong moment. On Apache with mod_php, one request can trigger it before any application code runs, and full remote code execution was shown with default settings. CVE-2026-109619 is PHP reusing leftover state from an earlier request after its memory was freed (GitHub advisory). Every PHP install that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (CERT-EU).

Reaching home services through a VPN like WireGuard or Tailscale instead of port forwarding keeps them off the open internet.