Thoughts on the PHP vulnerability
Apparently
For days now, IT and cybersecurity have been in the headlines. The PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), also known as PHP2SHELL, are rightly classified as highly critical vulnerabilities. Administrators must act quickly, as these flaws allow for the injection of executable code (Remote Code Execution, or RCE). However, media coverage often creates the impression that only websites — such as the online presence of companies, organizations, or individuals — are affected. This is not the case. Any device that uses a web-based interface powered by PHP for its own management — and is accessible from the public internet — is also at risk.
Affected devices include, but are not limited to:
- Firewalls, routers, wireless access points, and switches
Fortigate, Checkpoint, pfSense, OPNsense, DrayTek, ZyXEL, D-Link, TP-Link, Netgear, ... - NAS systems
Synology, QNAP, ... - Smart devices
Shelly, ...
Generally not affected:
- ASUS, UniFi, FRITZ!Box, and the DUDA website builder.
- Printers and household appliances are also typically unaffected, though you should verify this on a case-by-case basis!
What to do?
Immediate action is required!
For all devices that have a web interface accessible via the public internet:
- As long as a patch or update has not yet been installed, take the affected service offline or disable access to the web interface from the public internet.
- Install the relevant patches or updates as soon as possible.
- If you are unsure how to proceed, consult a specialist.
- Devices with web-based management that use PHP — even those not accessible from the public internet — must also be patched.
If an intruder manages to gain access to your network, such vulnerable devices become prime targets, allowing hackers to establish a long-term, undetected presence and cause further damage.
While the urgency may be slightly lower in these cases, these devices must not be overlooked—especially when they are firewalls or NAS systems used for backups.
Prevention
Prevention is more cost-effective than remediation. In the event of a serious incident, you lose significant employee productivity, as well as time spent on repairs, forensic analysis, system restoration, and managing the reputational damage that occurs if customer data ends up on the internet. All of this results in costs far higher than those of implementing proactive, preventive measures.
- Document your infrastructure and its interdependencies.
In an emergency, time is scarce; do not waste it researching information that you could—and should—already have on hand. - Take this opportunity to disable all public internet access to web interfaces and internal systems that are not strictly necessary (following the principle of least privilege).
- If you have not already done so, consider deploying a Next-Generation Firewall (NGFW) equipped with an Intrusion Prevention System (IPS) or, even better, a Web Application Firewall (WAF).
Basic stateful firewalls and standalone antivirus solutions have long been insufficient.
Unlike a simple Intrusion Detection System (IDS) — which merely issues alerts — an IPS takes active, real-time action by discarding malicious data packets or terminating active connections.
Advance warning
This incident involving the PHP2SHELL vulnerability clearly demonstrates how both cybersecurity specialists and hackers are leveraging AI to identify and exploit security gaps. The time elapsed between the disclosure of a vulnerability and the first subsequent attacks is shrinking rapidly — from days to mere hours — and there is reason to fear that autonomous AI systems will eventually enable fully automated attacks that take only minutes to execute.
The next security vulnerabilities—such as NODE2SHELL, which also allows for remote code execution (RCE)—are already on the horizon. Since these are based on Node.js, it becomes even more difficult for users and administrators to determine everywhere they might be present.
