Security Advisory

PHP2Shell: What You Need to Know & What We Are Doing

Last Updated: October 22, 2026 | 7pm ET

Two critical security flaws in PHP, the software behind most of the world's websites, were made public on October 21, 2026. This page explains what they mean for your business, what Endeavor IT is doing, and what you should do now. We post status changes here as soon as they are known.

Threat Summary

What Is PHP2Shell?

PHP is the software that runs a large share of websites, online stores, client portals, and the management screens of many network devices. Two flaws in PHP, nicknamed PHP2Shell, could let an attacker take control of an affected server without a password. The PHP project released fixes on October 21, 2026.

Security firms reported attack attempts before the fixes were even available, so these flaws need prompt attention. The good news is that the fix is clear: update PHP, or apply the update your vendor provides.

What is affected: The flaws affect websites, web applications, and hosting platforms. They also affect some firewalls, storage devices, and phone systems that use PHP behind the scenes.

What is usually not the concern: For most businesses, the laptops and desktops your team uses every day are not at risk. The exception is a computer where someone has installed web development software that includes PHP.

Stay Informed

Updates and How to Reach Us

How to Reach Us: For questions or requests about this issue, email our Support Services team at help@endeavorit.com to open a ticket, or contact your vCIO, CSM, or Account Manager.
Status Updates: We post status changes to this page as soon as they are known.
If Something Affects You: If we confirm anything that affects your systems or your data, including any incident involving your data, specific to this PHP vulnerability, we will notify you directly within 24 hours of confirming it. Our goal is to notify you immediately.

Our Response

What Endeavor IT Is Doing

If Endeavor IT manages your servers, firewalls, or other network equipment, we are reviewing those systems for these vulnerabilities now. Our review covers only the systems we manage for you. For systems managed by you or another provider, see "What You Should Do Now" below. You do not need to open a ticket for us to start.

Internet-facing systems come first. We are starting with systems that can be reached from the internet, because they carry the most risk.
We are updating where fixes exist. Where a vendor has released a fix, we are applying it.
We are restricting or taking offline what cannot be fixed yet. The NSA and CISA both recommend taking a system offline if it cannot be updated right away. Status: No systems have been taken offline or had access restricted.
We are checking for signs of compromise. Status: No signs of compromise have been detected.

Our services to you: No Endeavor IT service is currently offline, degraded, or otherwise affected.

If we find something that affects you, we will notify you directly within 24 hours, before anything about it appears on this page.

What You Should Do Now

Most businesses have at least one system that Endeavor IT does not manage. Your website is the most common example. These steps cover the things only you can set in motion.

Ask your website host or developer for a written answer. Your website is likely hosted by a web agency or hosting company, not by Endeavor IT. Ask them one question: "Have you applied the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 to the server that runs our website?" Ask for a yes or no in writing, not general reassurance.
Ask the same question of other web-based services you rely on. This includes customer portals you offer, online booking or ordering systems, and industry software that you reach through a web browser.
Tell us about systems we may not know about. If your business runs a website, portal, phone system, or other web-based tool that Endeavor IT does not manage, let us know. We can help at your request, as described below.
Do not leave an unpatched system running. The NSA and CISA both recommend taking a system offline if it cannot be updated right away. If a vendor tells you a fix is not available yet, ask what they recommend in the meantime.

Additional Support

Need Help With a System We Do Not Manage?

If a system on this page, or any other system that uses PHP, is not managed by Endeavor IT, the responsibility for patching it sits with its owner or vendor. At your request, we will make every reasonable attempt to help you assess it, work with the vendor, or apply available fixes. Contact us to discuss your situation and the options available. To make a request, email our Support Services team at help@endeavorit.com to open a ticket, or contact your vCIO, CSM, or Account Manager.

Endeavor IT Tools

The Tools and Services We Use to Support You

Last Updated: October 22, 2026 | 7pm ET

We are working with our vendors to verify whether any of the tools and services Endeavor IT uses to support you are affected. That review covers the systems we host ourselves, the services our vendors provide, and any PHP bundled inside vendor products. It also covers every system that stores, processes, or transmits your data or your customers' personal information, along with the client portals and other web-based services we provide to you.

At this time, we are not aware of any systems affected by this vulnerability.

The Endeavor IT website does not run on PHP.

We will update this section as each vendor confirms its status. If we find that a tool or service handling your data is affected, we will notify you directly within 24 hours.

Product & Patch Updates

Vendor Status

The table below summarizes what vendors have published about these flaws. Statuses change often, so always check the vendor's own page for the latest information. If a system you use is not listed, the Dutch National Cyber Security Centre maintains a broader list of more than 600 products: NCSC-NL PHP2Shell tracker.

Disclaimer: These statuses are Endeavor IT's summaries of vendor statements as of the date shown, provided without warranty, so confirm the latest details on each vendor's own page.

PHP Itself

Vendor	Product	Status	Details	Link
PHP	PHP runtime	Affected: fix available	Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official release, so those systems need a vendor-patched package or an upgrade to a supported version.	PHP advisory

Firewalls and Network Equipment

Vendor	Product	Status	Details	Link
Palo Alto Networks	PAN-OS and Panorama	Affected: no fix yet	All versions are affected and fixed releases have not shipped. Palo Alto recommends limiting management access to trusted internal addresses until fixes are available. The GlobalProtect App and Prisma Access Agent are listed as not impacted.	Palo Alto advisory
Fortinet	FortiGate (FortiOS), FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC	Not affected	Fortinet has confirmed these products are not impacted.	Fortinet advisory
Fortinet	FortiClient EMS, FortiSIEM, FortiMonitor, FortiADC, FortiSOAR, FortiDDoS, and other listed products	Under investigation	Fortinet is still reviewing these products and has not published fixed versions.	Fortinet advisory
Cisco	Multiple products and cloud services	Under investigation	Cisco has not listed any products as affected or as confirmed safe. Products under review include ISE, Catalyst Center, Catalyst SD-WAN Manager, Expressway, Umbrella, Secure Access and Webex. Cisco states that no workarounds exist.	Cisco advisory
SonicWall	[Name the products listed in SonicWall's notice]	Not affected	SonicWall's initial review found no use of PHP in the products listed in its notice.	SonicWall notice
SonicWall	Switches and SonicWave access points	Under investigation	SonicWall is still evaluating these products.	SonicWall notice
WatchGuard	All products	Not affected	WatchGuard's initial assessment is that none of its products are affected. Its review is continuing.	WatchGuard advisory
Sophos	All products	Not affected	Sophos states that none of its products are affected.	Sophos advisory
OPNsense	OPNsense firewall	Affected: fix available	OPNsense has released fixes for its Community and Business editions.	OPNsense notice
Netgate	pfSense	Under investigation	The older pfSense web interface uses PHP. Netgate has published fixes.	Security update
Ubiquiti	UniFi	No vendor statement	Ubiquiti has not published a statement on these flaws.

Storage Devices

Vendor	Product	Status	Details	Link
Synology	PHP packages, Mail Station, and Synology Calendar	Affected: fix available	Synology has released fixed versions of Synology Calendar, Mail Station, and PHP 7.4 through 8.4. PHP 7.3 will not receive a fix because it has reached end of life.	Synology advisory
QNAP	Multiple products	Affected: see details	QNAP states that multiple products are affected. See QNAP advisory QSA-26-18 for affected products and fixed versions.	QNAP statement

Hosting Platforms

Vendor	Product	Status	Details	Link
Plesk	Plesk for Linux and Windows	Affected: see details	Fixed versions of PHP 8.2 through 8.5 are available, and Plesk has rebuilt PHP 7.4, 8.0 and 8.1 with fixes. The PHP that runs the Plesk control panel itself needs a separate update.	Plesk advisory
cPanel	cPanel and WHM	Affected: fix available	Patched PHP packages are available, including fixes for PHP 7.4, 8.0 and 8.1. cPanel's own internal PHP has also been patched.	Security release
Microsoft	PHP on Azure	Affected: see details	Customers running PHP on Azure must update PHP to a fixed version. Microsoft is rolling out a protective rule for Azure Front Door through October 28 as interim protection.	Microsoft guidance
Canonical	Ubuntu	Affected: fix available	Fixes are available for supported Ubuntu releases, and older releases receive fixes through Ubuntu Pro. PHP and the web server must be restarted after updating.	Ubuntu notice
Red Hat	Red Hat Enterprise Linux	Affected: see details	Red Hat has released fixes for several PHP versions. Some were still awaiting fixes at last check.	Security release

Applications

Vendor	Product	Status	Details	Link
WordPress	WordPress websites	Affected: see details	WordPress sites are exposed if the server they run on uses an unpatched version of PHP. The fix is a PHP update on the hosting server, not a WordPress update. Ask your hosting provider to confirm in writing that PHP has been patched.
Sangoma	FreePBX and PBXact	Affected: see details	FreePBX 17 runs on PHP 8.2, and a fixed package is available through Debian 12. FreePBX 16 and 15 run older PHP versions that no longer receive updates, so contact Sangoma about patched packages or plan an upgrade.
VitalPBX	VitalPBX	Affected: fix available	VitalPBX advises installing Debian 12's fixed PHP 8.2.35 package.	VitalPBX guidance
Nextcloud	Nextcloud server	Affected: see details	Nextcloud servers running an affected PHP version are vulnerable. Update PHP on the server. The All-in-One container update was still pending at last check.

Questions?

We're Here to Help!

If you have questions about how this affects your business, or need to make a request, email our Support Services team at help@endeavorit.com to open a ticket, or contact your vCIO, CSM, or Account Manager. Managed clients do not need to open a ticket for us to begin reviewing the systems we manage for them.

About These Updates

Disclaimer

The information on this page, including the vendor status list and the guidance in "What You Should Do Now," is provided for general informational purposes. The vendor statuses are Endeavor IT's summaries of information published by each vendor as of the date shown, and they may not reflect a vendor's latest update. Always confirm current details on the vendor's own page. This information is provided as is, without warranty of any kind, and it is general guidance rather than advice tailored to your environment. A "Not affected" or "Under investigation" status reflects the vendor's statement, not an independent test by Endeavor IT. Nothing on this page changes or overrides the commitments in your agreement with Endeavor IT.