Does PHP2Shell affect my phone? What the PHP vulnerability means for iPhone and Android

iPhoneAndroidUpdated

The PHP project's advisory of 21 October 2026 says the installations at risk are "all PHP installations serving web requests", which is server software. It doesn't mention phones, tablets or browsers. Browsing a website on your iPhone or Android phone doesn't run that site's PHP on the phone, though a hacked site can still cause trouble in other ways.

Quick answer

PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. The PHP advisory says they put PHP installations serving web requests at risk, and the PHP manual says PHP code runs on the server. Your phone receives the finished page. Keep iOS or Android updated anyway, and be careful with downloads and logins on unfamiliar sites.

What does the PHP advisory say is affected?

Servers that run PHP to answer web requests. The advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 "fix two critical vulnerabilities that can allow unauthenticated remote code execution". Under "Who is at risk" it lists "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed", and it rates the risk highest for mod_php.

Those are ways of running PHP behind a website. The UK's NCSC aims its advice at organisations: find every PHP installation, update it and check for signs of compromise. Our PHP2Shell explainer covers the flaws themselves, and the further, much less likely issue the PHP project published on 23 October.

Why doesn't browsing on a phone run the PHP?

Because of where PHP does its work. The PHP manual says that, unlike client-side JavaScript, "the code is executed on the server, generating HTML which is then sent to the client."

Your phone's browser is the client in that sentence. It gets the HTML, not the PHP that made it, so fixing PHP2Shell is the site owner's job.

The advisory doesn't mention iOS or Android, and this guide makes no claim about what software sits inside either. What the sources do support is narrower: the advisory concerns PHP serving web requests, and a phone reading a web page is on the receiving end.

Can a hacked website still cause problems on my phone?

It can, in a different way, and one detail matters for phones. Google's guidance for site owners says hackers may inject code that redirects some users to harmful or spammy pages, and that the kind of redirect sometimes depends on the referrer, user agent or device. So a hacked site could behave differently on your phone than on a laptop.

Our guide to whether visiting a hacked website can hack you covers what a hacked site can do, browser warnings, and what to do if you've already typed a password somewhere you shouldn't have. For accounts with services you use, see whether your personal data is at risk.

How do I update my iPhone?

Apple says keeping your software up to date "is one of the most important things you can do to maintain your Apple product's security". It isn't a PHP2Shell fix, just good practice the NCSC recommends too.

  1. Back up your iPhone with iCloud or your computer.
  2. Plug it in and connect to Wi-Fi.
  3. Go to Settings > General > Software Update.
  4. If an update is available, tap Download and Install and follow the onscreen instructions.

To have updates install themselves, go to Settings > General > Software Update > Automatic Updates and turn on Automatically Install. Apple says this installs updates overnight while the phone is charging and on Wi-Fi, and notifies you first.

How do I update an Android phone?

To check your version, open the Settings app, tap About phone, then Android version, to see your Android version, Android security update, Google Play system update and build number.

  1. Connect to Wi-Fi and charge the phone. Google suggests at least 75%, since updates can be large.
  2. Go to Settings > System > Software updates.
  3. Check the status there and follow the on-screen prompts.

Google says update schedules "vary by device, manufacturer and mobile operator", so the exact menu can differ on a phone that isn't a Pixel.

Where should I get apps from?

The official stores, and the NCSC's advice is to keep those apps updated too: "You should apply updates to your apps and your device's software as soon as they are available."

On iPhone, apps come from the App Store, and Apple says 100% of apps there are automatically screened for known malware. On Android, Google Play Protect checks your apps and devices for harmful behaviour, and runs a safety check on Play Store apps before you download them. To check it's on, open the Play Store, tap your profile icon, then Play Protect > Settings, and make sure Scan apps with Play Protect is turned on.

Where Failshot fits

Failshot for iPhone and Android is coming soon.

On a Mac, Failshot is second layer device security. Your password is the first layer, and Failshot is the layer after it, for the moment someone sits down at your Mac and unlocks it. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

The Mac app is a free download from failshot.app for macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Is there a PHP2Shell update for iPhone or Android?

The PHP advisory doesn't mention one. As of 23 October 2026, its fix is new PHP releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It names no phone software. Install Apple's and Google's own updates as they arrive, whatever they cover.

My phone is old and no longer gets updates. Should I worry about PHP2Shell?

PHP2Shell itself concerns servers, so that isn't the reason. The NCSC's wider point stands, though: a phone that no longer gets security updates from its manufacturer is less secure, and it advises against using phones that are no longer supported.

Does PHP2Shell affect my Mac or laptop?

That depends on whether PHP is installed on it, which is a separate question from your phone. Our guide to whether PHP2Shell affects your Mac shows how to check in Terminal and how to update.

Should I stop using websites until this is fixed?

Neither the PHP advisory nor the NCSC alert tells the public to stop using websites. Their advice is for whoever runs PHP: update it. As a visitor, the usual care applies, especially with downloads and login pages.

Sources