Guidance regarding the October 21, 2026 PHP vulnerability 

PHP vulnerabilities can allow unauthenticated remote code execution. Any device, server or web service that uses PHP must be updated/patched immediately. 

Who is at risk:  

  • All PHP installations serving web requests, including  

    • PHP-FPM 

    • Apache with mod_php 

    • php-cgi 

    • FrankenPHP  

    • LiteSpeed

  • We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. 

Third party vendors 

If you have a contract with a third-party vendor, contact them to ask if they are affected by the PHP2Shell vulnerability. If they are affected, ask about the timeline to patch and which mitigations are currently in place to reduce the risk of compromise. 

*As an example, we reached out to the vendor that provides the Knowledge base to NDSU and learned that they were going to bring the KB down for a period of time until they had a patch complete.  

Servers 

If your department runs servers that may have PHP installed, determine if they are running PHP and then take the appropriate steps to patch each server. If there is no patch available yet, the recommendation is to limit access to internal IP’s only or shut it down until a patch is available. 

Personal computers 

PCs and Macs do not run PHP by default, however, individuals may have installed applications that have PHP. If you have any software that was not part of the base image of a computer,  you will need to determine if it is running PHP and update it accordingly. 

Tablets 

Depending on the manufacturer, tablets may run PHP by default. Make sure to install updates as soon as they are available.  

Printers 

If you have any printers that are not managed by Print and Copy, check the manufacturer’s page and install updates as they are released. Older models may not receive updates and will remain vulnerable unless the manufacturer provides patches.  If there is no patch available yet, the recommendation is to limit access to internal IP’s only or shut it down until a patch is available. This is also a good opportunity to verify that your printer is using a private IP address. 

Other devices 

Other devices such as cameras, scanners, TVs, smart devices, Polycoms, and any device that connects to the internet and has a webpage to manage it. Check the manufacturer’s page to determine if an update for the device is available. Older models may not receive updates and will remain vulnerable unless the manufacturer provides patches. If there is no patch available yet, the recommendation is to limit access to internal IP’s only or shut it down until a patch is available. 


Keywords:
php cyber security vulnerability 
Doc ID:
165011
Owned by:
Kristi S. in NDSU IT Knowledge Base
Created:
2026-10-22
Updated:
2026-10-22
Sites:
NDSU IT Knowledge Base