Yes, many tools your security and IT teams run are PHP applications. MISP, the threat sharing platform, is one, and Passbolt, a password manager, is another. So are GLPI, Zabbix, Cacti and phpMyAdmin. Some products you buy run PHP too, inside their management interface.
That matters because of PHP2Shell, two critical remote code execution vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. A vulnerability in the runtime reaches every application that runs on it, and each application gets its PHP patch by a different route. This post lists the tools and the commercial products, shows who ships the patch, and gives your vulnerability management team a plan.
Twelve Self-Hosted Tools and the PHP Versions They Need
The table covers twelve tools. Each row comes from the project’s own repository or documentation, not from a third-party list. The PHP column shows what the project requires for its current release line, so it changes with each release.
| Tool | PHP requirement | Install route |
|---|---|---|
| MISP | PHP 8.1 or newer, below 9 (composer.json of release 2.5) | Ubuntu 24.04 installer, or misp-docker |
| Passbolt | PHP 8.2 or newer (composer.json) | Packages for many Linux systems, Docker or Kubernetes |
| GLPI | GLPI 10: PHP 7.4 or newer. GLPI 11: 8.2 or newer. GLPI 12: 8.3 or newer (composer.json) | Source archive on your own web server |
| Snipe-IT | PHP 8.2 up to, not including, 8.6 (docs v8.8.0) | Git, release archive, Linux installer or Docker |
| osTicket | PHP 8.2 to 8.4, with 8.4 recommended | Release files uploaded to your web server |
| Zabbix frontend | Zabbix 7.4: PHP 8.0.0 to 8.5.X | Distro packages, containers, virtual appliance or source |
| Cacti | Cacti 1.2.31 and later: PHP 8.1 or greater | Release package on your own web server |
| LibreNMS | Minimum PHP 8.4, recommended 8.5 | Git clone onto your own Linux server |
| phpMyAdmin | PHP 7.2.5 or newer (5.2 docs) | Archive in the web root, official Docker image or Composer |
| Nextcloud | PHP 8.3, 8.4 or 8.5 (admin manual 35) | All-in-One image, Snap, VM appliance or tar archive |
| Roundcube | PHP 8.1 or greater (master branch docs) | Release package behind your own web server |
| Matomo | Matomo 5: PHP 8 (6.0.0 beta: PHP 8.1 or newer) | Upload to your web server, or the official Docker image |
Each row follows the project’s own requirement page. Open it to check the line you run.
- MISP
- Passbolt
- GLPI
- Snipe-IT
- osTicket
- Zabbix frontend
- Cacti
- LibreNMS
- phpMyAdmin
- Nextcloud
- Roundcube
- Matomo
Read the table from right to left. The install route tells you who will patch PHP, which is the next question. Old minimums matter too: GLPI 10 and phpMyAdmin still accept PHP 7.2 to 7.4 lines that have been end of life for years.
- PHP-FPMThe process manager that runs PHP workers for a web server.
- BackportA fix copied from a newer version into an older one, often under the old version number.
- Remote code executionA flaw that lets an attacker run their own code on your server.
We left out any tool whose own documentation did not state its PHP use. This list is a sample. It says these tools run PHP, not that any of them is exploitable. That depends on the PHP build and on what is exposed.
Which Commercial Security Products Run PHP Inside?
The twelve tools above are ones you install yourself. Products you buy can run PHP too, usually in the web interface that manages them. You cannot see that PHP, and you cannot patch it. The vendor ships it inside the firmware or the software image.
The UK NCSC tells organizations to watch for updates from vendors whose appliances may bundle PHP. The Dutch NCSC keeps a public inventory of software with a PHP dependency. It was our starting point. We kept only products where a vendor page confirms the status.
The table shows what each vendor said on 24 October 2026. These pages change daily, so open the vendor page before you act. Where a vendor does not say where the PHP sits, the table says so.
| Vendor and product | Where the PHP sits | PHP2Shell status, 24 October | What you can do |
|---|---|---|---|
| Palo Alto Networks PAN-OS and Panorama | The management web interface: the HTTPS web UI and the XML API | Affected on 10.2, 11.1, 11.2, 12.1 and 12.2. Hotfix dates by release train are in our Palo Alto post. Palo Alto knows of no malicious exploitation | Allow management access only from trusted internal IPs. Install the hotfix for your release train when it ships |
| Citrix NetScaler ADC and Gateway | Management access. Citrix titles its own guide “Protecting NetScaler management access from PHP” | Impacted, says Citrix advisory CTX697263 of 22 October. The page names no fixed build | Follow the Citrix mitigation guide. Keep NetScaler management addresses off the internet |
| F5 BIG-IP | The Configuration utility, and on APM and SSLO the access-profile pages. An older F5 bug record shows PHP inside BIG-IP TMOS | Affected, per F5 article K000163821. Read it for the current mitigations and fixed releases | Restrict the Configuration utility to a management network. Apply the APM and SSLO mitigation in K000163821, then the fixed release once it lists one |
| Netgate pfSense Plus and CE | The PHP GUI, the web interface, and the Captive Portal | Fixed PHP packages out since 21 October: Plus 26.07 and 26.03.1, CE 2.9.0 and 2.8.1 | Update the PHP packages from the command line, not the GUI. Then reboot, or restart the GUI and Captive Portal. Keep the GUI off the internet |
| OPNsense | The web GUI and API frontend. The OPNsense docs say it is built with PHP and Phalcon | Hotfix out: Community 26.7.7 and 26.1.11, Business 26.4.2p4, with PHP 8.5.12 or 8.3.36 | Install the hotfix. Restart the captive portal service after the update |
| Cisco Expressway, URWB and Duo Access Gateway | Cisco does not say where the PHP sits | Affected. Fixed: Expressway 15.5.21 (date not set), URWB 27.1.1 (estimated February 2027), Duo Access Gateway 3.2.0 | Apply the fix for your product. Expressway and URWB have workarounds in the Cisco bug record |
| Barracuda Firewall Insights and SecureEdge | Barracuda does not say where the PHP sits | Patch released for both. The Backup Service Appliance was still being remediated | Firewall Insights: apply the firmware update in its web interface. SecureEdge: apply the patch at once or turn on Auto Update |
| HPE Networking ClearPass Policy Manager | The CLI and web management interfaces and the guest portals, per HPE’s workaround | Affected: ClearPass 6.14.1, 6.11.16 and older. HPE released hotfix patches for 6.14.1 and 6.11.16 that fix it completely, in the bulletin updated 24 October | Install the PHP hotfix patch for your version. Keep management on a dedicated segment and guest portals off public access until the hotfix is installed |
| NetApp ONTAP 9 | The web server, where PHP runs inside a restricted “PHP jail” | Affected by CVE-2026-109618 only. An attacker would get the www user inside the jail. No fixed release was listed on 22 October | Follow NetApp advisory NTAP-20261021-0021 and install the fix when it ships |
The vendor pages behind the rows:
- Palo Alto Networks advisory and our hotfix dates post
- Citrix advisory CTX697263
- F5 article K000163821 and F5 bug record ID1270257
- Netgate: critical PHP security update
- OPNsense team announcement and OPNsense frontend docs
- Cisco advisory
- Barracuda advisory
- HPE bulletin HPESBNW05171
- NetApp advisory NTAP-20261021-0021
Several vendors say their main platforms are clear. Fortinet lists FortiOS, FortiMail, FortiWeb and FortiManager as not impacted, but FortiDDoS and FortiSOAR were still under investigation on 23 October. WatchGuard says its first assessment found no affected product.
SonicWall found no PHP use in SonicOS, SMA 1000, NSM and Email Security, and was still evaluating its switches and SonicWave access points. Cisco lists Secure Firewall ASA, Threat Defense and Management Center as not vulnerable.
Sophos says none of its products are affected. Its advisory adds that a hosted licensing portal for end-of-life SG UTM ran an affected PHP version, and Sophos took it offline on 21 October. Barracuda lists CloudGen Firewall, Email Security Gateway and its web application firewall as not affected.
A “not affected” line is the vendor’s view of these two flaws. It does not promise that the product has no PHP. Check Point published an IPS protection on 21 October. It detects exploitation attempts and is not a product status.
Juniper’s 2024 bulletin shows that J-Web, the web interface of its SRX and EX devices, ships PHP. Juniper has a PHP2Shell status page for its products, so check it for J-Web.
For every product in the table, the action is the same. Limit the management interface to trusted internal addresses, then install the vendor update the day it ships. Palo Alto and Netgate both single out an exposed management interface.
Who Ships the PHP Patch in Each Setup?
The same flaw sits in the same layer everywhere, but a different party fixes that layer. The diagram shows the stack from top to bottom.
- Application codeMISP, GLPI and Zabbix ship their own releases, but not your PHPPatched byThe project or vendor
- PHP runtimeFixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35Patched byYou, your distribution, or the image maintainerWhere PHP2Shell sits
- Container image or applianceA host update does not change the PHP inside an imagePatched byImage maintainer or hardware vendor
- Operating system packagesBackports may keep the old version numberPatched byYour distribution
- Host and web serverRestart PHP workers after every updatePatched byYou
For a tool installed from an archive, such as GLPI, Cacti or osTicket, you run the server, so you patch PHP. Adobe says the same about Adobe Commerce (Magento) on your own servers: its documentation lists security patching for PHP as the customer’s job.
For distribution packages, your distribution ships the fix. For Docker images, the maintainer must rebuild the image, and you must pull it. For appliances, the vendor decides.
On an appliance you cannot patch PHP yourself. In the table above, the fix is always the vendor’s own hotfix or package update. Palo Alto gave estimated hotfix dates in its advisory. We cover them in our Palo Alto status post.
The docs name the install method. The patch route follows from it, so check the route with your own team before you rely on it.
What Should a Vulnerability Management Team Do?
CISA and the UK NCSC both told organizations on 21 October to find every PHP system and patch the internet-facing ones first. The steps below turn that into a routine.
- Inventory every PHP runtimeRun php -v and php-fpm -v on each host, and check cron jobs that call the PHP command line.
- Look inside images tooRun php -v in each container image, because the host package list does not show it.
- Name an owner and a patch routeFor each tool, write down who ships the fix: you, your distribution, an image maintainer or the vendor.
- Patch by exposureUpdate internet-facing hosts first, restart the PHP workers, then do internal tools such as monitoring and ticketing. On an appliance, limit the management interface first, then install the vendor hotfix.
- Add controls and scan againTurn off session.upload_progress.enabled where you can, and keep the WAF on. Then re-scan to confirm the new version.
PHP says its workarounds close only some attack paths, so a control buys time but is not a fix. A WAF lowers the risk but does not change the PHP version either. See the PHP2Shell fixed versions post for the exact settings.
PHP 8.1 and older get no new official release, and PHP 8.2 reaches end of life on 31 December 2026. For these lines, ask your distribution or vendor for a backport, or move to a supported branch. A tool that allows an old PHP line can quietly stay on it.
How Does Brandefense Help Find PHP You Did Not List?
The routine above covers hosts you know. The hard part is the host nobody listed. Think of a forgotten test server or a tool a team installed on its own. Think of a firewall management page left open to the internet, or a service a vendor runs for you.
Our External Attack Surface Management (EASM) is built for that gap. It works from the outside, as an attacker would.
EASM runs continuously, unlike a periodic scan, and Brandefense EASM scans internet-facing assets within minutes. It does not replace the host inventory, because tools on internal networks stay out of its view. Use both: inside lists for what you know, outside discovery for what you missed.
For a single site, use the free Atlas PHP vulnerability check. It makes one request to your public homepage, reads the PHP version the server advertises and compares it with the fix. It is passive and sends no exploit traffic. If the server hides its version, the check says so, and a hidden version is not a patched one.
Old PHP is common. In our free check, 445 of 867 vulnerable sites ran PHP 8.1 or older, as of 22 October. The numbers are in our end of life post, and they show why the inventory matters. Start today: list the PHP in your security and IT tools, write the patch route next to each, and run the Atlas check on every public address you own.