Is your router or home firewall running PHP? What PHP2Shell means for it

WindowsMacUpdated

Netgate, which makes pfSense, and the OPNsense team both shipped PHP updates for their firewall software on 21 October 2026, the day the PHP project announced the PHP2Shell flaws. Whether an ordinary home router is affected depends on whether its maker built PHP into it, and only the maker can tell you that.

Quick answer

PHP2Shell affects PHP installations that serve web requests, and some network devices use PHP for their admin pages. pfSense and OPNsense have published fixes. For any other router, check the maker's support page for a firmware update, keep its admin page off the internet, and install updates as they arrive.

Does PHP2Shell affect my router?

Only if your router runs PHP, and most owners have no way to see that from the outside. The PHP project's advisory says the two flaws, CVE-2026-109618 and CVE-2026-109619, put all PHP installations serving web requests at risk, and that they can allow unauthenticated remote code execution. In plain terms, someone could run their own commands on the device without logging in.

CISA, the US cyber security agency, says PHP is often a component of other software and its prevalence may not be directly observable. The NCSC, the UK's National Cyber Security Centre, says PHP is also used in a range of other products. So a device can contain PHP without saying so on the box.

We haven't named any consumer router brand on this page, because we only list a maker when its own advisory says its products are affected or fixed. The two that have said so are below.

What does Netgate say about pfSense?

Netgate's post of 21 October 2026 says the two vulnerabilities affect pfSense software installations. It adds that they are only a cause for concern if the pfSense PHP GUI, its web admin page, or the Captive Portal service is exposed to potential attackers.

By default, Netgate says, the admin page is only reachable from the local network, not from the internet, and Captive Portal is not switched on. These are the versions it lists as updated:

  1. pfSense Plus 26.07 and 26.03.1, and pfSense CE 2.9.0, now with PHP 8.5.12.
  2. pfSense CE 2.8.1, now with PHP 8.3.36.

The update can't be done from the web admin page. Netgate says it has to be run at a command line over SSH or the console, and its post gives the exact commands. Anyone who has exposed the admin page to the internet should update immediately, change their rules and, from then on, reach the admin page only by secure means such as a VPN. Captive Portal users should update as soon as possible. Everyone else, Netgate says, should still update when convenient.

What does OPNsense say?

OPNsense's announcement of 21 October 2026 lists hotfixes with updated PHP: Community Edition 26.7.7 with PHP 8.5.12, Community Edition 26.1.11 with PHP 8.3.36, and an update for the Business Edition. OPNsense's 26.7 release notes list the out of band hotfix for CVE-2026-109618 and CVE-2026-109619, PHP 8.5.12, under 26.7.7.

OPNsense's announcement strongly recommends installing the update as soon as possible. If you use the captive portal, it says to restart the captive portal service after installing, so the fixes take effect.

What do CISA and the NCSC say about devices that bundle PHP?

Both agencies' advice is written for organisations, and both point beyond the servers people set up themselves. The NCSC's advice is to keep watching for security updates from third-party vendors, including for appliances and services that may bundle PHP. CISA's advice is to find and list every system running any version of PHP, apply the patch with internet-facing systems first, and take systems offline if they can't be updated.

For a home network, the practical version of that is your router maker's support page. On exploitation, CISA says in its alert of 21 October, revised on 23 October 2026, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". As of 23 October 2026, QNAP's advisory says exploitation attempts against PHP have been publicly reported.

What should I do with my home router?

Treat it like any device whose software you can't inspect yourself. CISA's home Wi-Fi guidance covers the parts that matter here, and it notes that each router is different, so the exact menus are in your router's user guide.

  1. Find your router's make and model and open the maker's support page for that model.
  2. Look for a security notice or firmware update. CISA says routine updates protect you against known vulnerabilities, and some routers can install them automatically.
  3. Install any firmware update the maker offers.
  4. Turn off remote management. CISA says this setting lets you log in to the router over the internet to make changes, and that disabling it means someone has to be on your network first to change it.
  5. Turn off UPnP unless you need it. Our guide to turning off UPnP and port forwarding explains why.
  6. If the router still has its default admin password, change it. CISA says default login details may be publicly available, and that the new password should be long, random and unique.

If you also have a NAS at home, Synology and QNAP have their own advisories. Our NAS guide covers what each one says.

More questions

Is there a list of products affected by PHP2Shell?

The NCSC links to a list of software products with a PHP dependency that may be affected, kept on GitHub by NCSC-NL. The list says it is being updated as the situation develops, so it's a starting point. Your router maker's own notice is the one to trust for your model.

Can I update PHP on my router myself?

On most home routers, no. You get PHP, if the router has it, inside the maker's firmware, so the fix arrives as a firmware update. pfSense and OPNsense are different: their owners install the updated PHP themselves, using the steps in each project's notice.

My router's admin page is only reachable at home. Am I safe?

Netgate says pfSense owners who keep the admin page off untrusted networks and don't use Captive Portal are not affected, but should still update. QNAP warns that limiting access to the local network doesn't protect against devices already compromised on it. Updating is still the fix.

Is there a workaround if no update exists yet?

The PHP project says only an update is a complete solution, and its interim settings reduce exposure without making an installation safe. Those settings are for people running PHP themselves. For a router, keeping the admin page off the internet and installing the maker's update is what you can control.

What is PHP2Shell?

It's the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS version 4.0, announced on 21 October 2026. Our PHP2Shell explainer covers the fixed PHP versions.

Sources