Security Advisory

PHP2Shell: What You Need to Know & What We Are Doing

Last Updated: October 29, 2026 | 11:15am ET

Two critical security flaws in PHP, the software behind most of the world's websites, were made public on October 21, 2026. On October 23, PHP announced a separate flaw, CVE-2026-115560, which affects far fewer systems. This page explains what they mean for your business, what Endeavor IT is doing, and what you should do now. We post status changes here as soon as they are known.

Threat Summary

What Is PHP2Shell?

PHP is the software that runs a large share of websites, online stores, client portals, and the management screens of many network devices. Two flaws in PHP, nicknamed PHP2Shell, could let an attacker take control of an affected server without a password. The PHP project released fixes on October 21, 2026.

Security firms reported attack attempts before the fixes were even available, so these flaws need prompt attention. On October 26, CISA added both PHP2Shell flaws to its catalog of vulnerabilities known to be exploited in real attacks. The good news is that the fix is clear: update PHP, or apply the update your vendor provides.

A separate vulnerability: On October 23, PHP announced CVE-2026-115560, a separate flaw that the October 21 fixes do not cover. PHP says it affects only systems with an unusual setup, and no attacks using it have been reported. PHP plans to fix it in its next regular release and recommends a configuration change in the meantime.

What is affected: The flaws affect websites, web applications, and hosting platforms. They also affect some firewalls, storage devices, and phone systems that use PHP behind the scenes.

What is usually not the concern: For most businesses, the laptops and desktops your team uses every day are not at risk. The exception is a computer where someone has installed web development software that includes PHP.

Stay Informed

Updates and How to Reach Us

How to Reach Us: For questions or requests about this issue, email our Support Services team at help@endeavorit.com to open a ticket, or contact your vCIO, CSM, or Account Manager.

Status Updates: We post status changes to this page as soon as they are known.

If Something Affects You: If we confirm anything that affects your systems or your data, including any incident involving your data, specific to these PHP vulnerabilities, we will notify you directly within 24 hours of confirming it. Our goal is to notify you immediately.

Our Response

What Endeavor IT Is Doing

If Endeavor IT manages your servers, firewalls, or other network equipment, we are reviewing those systems for these vulnerabilities now. Our review covers only the systems we manage for you. For systems managed by you or another provider, see "What You Should Do Now" below. You do not need to open a ticket for us to start.

Internet-facing systems come first. We are starting with systems that can be reached from the internet, because they carry the most risk.
We are updating where fixes exist. Where a vendor has released a fix, we are applying it.
We are restricting or taking offline what cannot be fixed yet. The NSA and CISA both recommend taking a system offline if it cannot be updated right away. Status: No systems have been taken offline or had access restricted.
We are checking for signs of compromise. Status: No signs of compromise have been detected.
We are protecting against CVE-2026-115560. Until PHP releases a fix, we are applying PHP's recommended setting to the systems we manage for you where it is needed.

Our services to you: No Endeavor IT service is currently offline, degraded, or otherwise affected.

If we find something that affects you, we will notify you directly within 24 hours, before anything about it appears on this page.

What You Should Do Now

Most businesses have at least one system that Endeavor IT does not manage. Your website is the most common example. These steps cover the things only you can set in motion.

Ask your website host or developer for a written answer. Your website is likely hosted by a web agency or hosting company, not by Endeavor IT. Ask them one question: "Have you applied the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619, and addressed CVE-2026-115560, on the server that runs our website?" Ask for a yes or no in writing, not general reassurance.
Ask the same question of other web-based services you rely on. This includes customer portals you offer, online booking or ordering systems, and industry software that you reach through a web browser.
Tell us about systems we may not know about. If your business runs a website, portal, phone system, or other web-based tool that Endeavor IT does not manage, let us know. We can help at your request, as described below.
Do not leave an unpatched system running. The NSA and CISA both recommend taking a system offline if it cannot be updated right away. If a vendor tells you a fix is not available yet, ask what they recommend in the meantime.

Additional Support

Need Help With a System We Do Not Manage?

If a system on this page, or any other system that uses PHP, is not managed by Endeavor IT, the responsibility for patching it sits with its owner or vendor. At your request, we will make every reasonable attempt to help you assess it, work with the vendor, or apply available fixes. Contact us to discuss your situation and the options available. To make a request, email our Support Services team at help@endeavorit.com to open a ticket, or contact your vCIO, CSM, or Account Manager.

Endeavor IT Tools

The Tools and Services We Use to Support You

Last Updated: October 29, 2026 | 11:15am ET

We have reviewed the tools and services Endeavor IT uses to support you, including the systems we host ourselves, the services our vendors provide, and the client portals and other web-based services we provide to you. None of them were affected by CVE-2026-109618, CVE-2026-109619, or CVE-2026-115560.

The Endeavor IT website does not run on PHP.

We will continue to monitor vendor updates. If anything changes that affects a tool or service handling your data, we will notify you directly within 24 hours of confirming it.

Product & Patch Updates

Vendor Status

The table below summarizes what vendors have published about these flaws. Statuses change often, so always check the vendor's own page for the latest information. If a system you use is not listed, the Dutch National Cyber Security Centre maintains a broader list of more than 600 products: NCSC-NL PHP2Shell tracker. Vendor statuses refer to CVE-2026-109618 and CVE-2026-109619 unless a row says otherwise.

Disclaimer: These statuses are Endeavor IT's summaries of vendor statements as of the date shown, provided without warranty, so confirm the latest details on each vendor's own page.

PHP Itself

Vendor	Product	Status	Details	Link	Last Verified
PHP	PHP runtime	Affected: fix available	Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official release, so those systems need a vendor-patched package or an upgrade to a supported version.	PHP advisory	10/29/2026 \| 11:15am ET
PHP	PHP runtime (CVE-2026-115560)	Affected: no fix yet	This flaw affects only systems with an unusual session setup. PHP plans to fix it in its next regular release and recommends turning off session upload progress until then. No attacks using it have been reported. Systems that already turned off session upload progress for the October 21 vulnerabilities need no further action.		10/29/2026 \| 11:15am ET

Firewalls and Network Equipment

Vendor	Product	Status	Details	Link	Last Verified
Palo Alto Networks	PAN-OS and Panorama	Affected: no fix yet	All versions are affected and fixed releases have not shipped. Palo Alto recommends limiting management access to trusted internal addresses until fixes are available. The GlobalProtect App and Prisma Access Agent are listed as not impacted.	Palo Alto advisory	10/29/2026 \| 11:15am ET
Fortinet	FortiGate (FortiOS), FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiClient EMS, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC, FortiADC, FortiEDR, FortiDDoS-F, and other products listed in Fortinet's advisory	Not affected	Fortinet has confirmed these products are not impacted.	Fortinet advisory	10/29/2026 \| 11:15am ET
Fortinet	FortiDDoS, FortiSOAR, FortiSOAR PaaS	Under investigation	Fortinet is still reviewing these three products.	Fortinet advisory	10/29/2026 \| 11:15am ET
Cisco	Meraki devices and Dashboard, Umbrella, Secure Firewall, Identity Services Engine (ISE), Catalyst Center, Catalyst SD-WAN, IOS and IOS XE, Webex, and Secure Access	Not affected	Cisco has confirmed these products are not affected. Cisco considers any product not listed in its advisory to be not affected.	Cisco advisory	10/29/2026 \| 11:15am ET
Cisco	Expressway Series and Expressway Select Series, Duo Access Gateway, ISE Portal Builder, Ultra-Reliable Wireless Backhaul, and Unified Industrial Wireless Software	Affected: see details	Expressway is fixed in version 15.5.21, and Duo Access Gateway is fixed in version 3.2.0. Cisco expects a fix for Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software in version 27.1.1 in November 2026. Cisco has taken ISE Portal Builder offline for remediation. Workarounds for some products are documented in Cisco's advisory.	Cisco advisory	10/29/2026 \| 11:15am ET
SonicWall	SonicOS (firewalls), SMA 1000 Series, Unified Management (UM), and Wireless Network Manager (WNM)	Not affected	SonicWall's initial review found no use of PHP in the products listed in its notice.	SonicWall notice	10/29/2026 \| 11:15am ET
SonicWall	Switches and SonicWave access points	Under investigation	SonicWall is still evaluating these products.	SonicWall notice	10/29/2026 \| 11:15am ET
WatchGuard	All products	Not affected	WatchGuard's initial assessment is that none of its products are affected. Its review is continuing.	WatchGuard advisory	10/29/2026 \| 11:15am ET
Sophos	All products	Not affected	Sophos states that none of its products are affected and that no customer action is required.	Sophos advisory	10/29/2026 \| 11:15am ET
OPNsense	OPNsense firewall	Affected: fix available	OPNsense has released fixes for its Community and Business editions.	OPNsense notice	10/29/2026 \| 11:15am ET
Netgate	pfSense	Under investigation	The older pfSense web interface uses PHP. Netgate has published fixes.	Security update	10/29/2026 \| 11:15am ET
Ubiquiti	UniFi	No vendor statement	Ubiquiti has not published a statement on these flaws.		10/29/2026 \| 11:15am ET

Storage Devices

Vendor	Product	Status	Details	Link	Last Verified
Synology	PHP packages, Mail Station, and Synology Calendar	Affected: fix available	Synology has released fixed PHP packages and fixed versions of Synology Calendar and Mail Station for DSM 7.2, 7.3, and 7.4, available through Package Center. PHP 7.3 will not receive a fix because it has reached end of life. On DSM versions before 7.2, Synology advises disabling the affected packages.	Synology advisory	10/29/2026 \| 11:15am ET
QNAP	Multiple products	Affected: see details	QNAP has released fixed firmware for QTS, QuTS hero, and QuTScloud. Fixes for some apps, including Note Station 3 and QVR Surveillance on ARM32 models, are still in progress. See QNAP advisory QSA-26-18 for fixed builds.	QNAP advisory	10/29/2026 \| 11:15am ET

Hosting Platforms

Vendor	Product	Status	Details	Link	Last Verified
Plesk	Plesk for Linux and Windows	Affected: see details	Fixed versions of PHP 8.2 through 8.5 are available, and Plesk has rebuilt PHP 7.4, 8.0 and 8.1 with fixes. The PHP that runs the Plesk control panel itself needs a separate update.	Plesk advisory	10/29/2026 \| 11:15am ET
cPanel	cPanel and WHM	Affected: fix available	cPanel has released fixed PHP packages through EasyApache 4 version 25.91, including fixes for PHP 7.4, 8.0, and 8.1. PHP 7.3 and older will not receive a fix from cPanel. Updating cPanel itself does not update these PHP packages, so both must be updated and PHP restarted.	Security release	10/29/2026 \| 11:15am ET
Microsoft	PHP on Azure	Affected: see details	Microsoft has patched the built-in PHP and WordPress images for Azure App Service on Linux. Customers must rebuild custom containers, move off end-of-life PHP versions, and update PHP on their own virtual machines.	Microsoft guidance	10/29/2026 \| 11:15am ET
Canonical	Ubuntu	Affected: fix available	Fixes are available for supported Ubuntu releases, and older releases receive fixes through Ubuntu Pro. PHP and the web server must be restarted after updating.	Ubuntu notice	10/29/2026 \| 11:15am ET
Red Hat	Red Hat Enterprise Linux	Affected: see details	Red Hat has released fixes for several PHP versions. Some were still awaiting fixes at last check.	Security release	10/29/2026 \| 11:15am ET

Applications

Vendor	Product	Status	Details	Link	Last Verified
WordPress	WordPress websites	Affected: see details	WordPress sites are exposed if the server they run on uses an unpatched version of PHP. The fix is a PHP update on the hosting server, not a WordPress update. Ask your hosting provider to confirm in writing that PHP has been patched.		10/29/2026 \| 11:15am ET
VitalPBX	VitalPBX	Affected: fix available	VitalPBX advises installing Debian 12's fixed PHP 8.2.35 package.	VitalPBX guidance	10/29/2026 \| 11:15am ET

Questions?

We're Here to Help!

If you have questions about how this affects your business, or need to make a request, email our Support Services team at help@endeavorit.com to open a ticket, or contact your vCIO, CSM, or Account Manager. Managed clients do not need to open a ticket for us to begin reviewing the systems we manage for them.

About These Updates

Disclaimer

The information on this page, including the vendor status list and the guidance in "What You Should Do Now," is provided for general informational purposes. The vendor statuses are Endeavor IT's summaries of information published by each vendor as of the date shown, and they may not reflect a vendor's latest update. Always confirm current details on the vendor's own page. This information is provided as is, without warranty of any kind, and it is general guidance rather than advice tailored to your environment. A "Not affected" or "Under investigation" status reflects the vendor's statement, not an independent test by Endeavor IT. Nothing on this page changes or overrides the commitments in your agreement with Endeavor IT.