Skip to content
PHP2Shell Vulnerability Exposes 96% of Internal PHP Devices

PHP2Shell Vulnerability Exposes 96% of Internal PHP Devices

First seen 2 Nov 2026, 04:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 06:16 UTC
  • •96% of PHP devices on internal networks are exposed to the PHP2Shell vulnerability.
  • •89% of vulnerable devices are on private IP ranges, making them undetectable by external scans.
  • •The vulnerability has been confirmed as actively exploited and added to the CISA KEV catalog.

Genians reported that 96% of devices running PHP on corporate internal networks are vulnerable to the PHP2Shell remote code execution flaw. This vulnerability affects devices such as NAS, routers, and CCTV systems, with 78% of vulnerable devices running unsupported PHP versions. The analysis revealed that 89% of these devices are located on private IP ranges, making them invisible to external scanners. Genians emphasized the need for organizations to inspect internal networks thoroughly, as traditional scanning methods focus mainly on external web servers. The PHP2Shell vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on October 26, indicating. Organizations are urged to isolate vulnerable devices and implement proactive controls until they can be replaced or patched.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-26
PHP2Shell added to CISA KEV catalog
The PHP2Shell vulnerability was confirmed as actively exploited and listed in the CISA Known Exploited Vulnerabilities catalog.
Finance.Biggo
2026-10-30
Genians releases vulnerability analysis
Genians reported that 96% of internal PHP devices are vulnerable to PHP2Shell, emphasizing the need for internal network inspections.
Finance.Biggo
2026-11-02
Thelec reports on PHP2Shell threat
Thelec highlighted the PHP2Shell threat extending to internal devices and the need for better visibility into internal networks.
Thelec

More articles in this cluster (2)

Extracted Entities (5)

1 / 3

Common questions

Which devices are affected by PHP2Shell?
Devices running PHP, including NAS, routers, firewalls, and CCTV systems, are affected.
Is PHP2Shell actively exploited?
Yes, it has been confirmed as actively exploited and was added to the CISA KEV catalog.
What actions should organizations take?
Organizations should conduct thorough inspections of their internal networks and isolate vulnerable devices immediately.