{"id":56592,"date":"2026-10-22T16:39:27","date_gmt":"2026-10-22T20:39:27","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=56592"},"modified":"2026-10-22T16:39:27","modified_gmt":"2026-10-22T20:39:27","slug":"how-to-mitigate-php2shell-at-home","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/how-to-mitigate-php2shell-at-home\/56592\/","title":{"rendered":"How new PHP vulnerabilities threaten home users"},"content":{"rendered":"

Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618<\/a> and CVE-2026-109619<\/a>. Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell.<\/p>\n

The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the very next day.<\/p>\n

We have already covered the technical details of these vulnerabilities<\/a> and explained what companies and server administrators should do<\/a>. You may have safely skipped that news because you do not run any servers \u2014 but unfortunately, the issue is not limited to businesses.<\/p>\n

Nearly 70% of websites run on PHP, including services we use every day: wikis, online stores, smart devices with web interfaces, home network-attached storage (NAS), smart-home controllers, and much more.<\/p>\n

Today, we explain how these vulnerabilities could affect you personally and what you can do to reduce the risks.<\/p>\n

How the vulnerabilities can affect home users<\/h2>\n

Account and personal-data theft<\/h3>\n

The vulnerability allows an attacker to steal authentication tokens from server memory. These tokens essentially act like electronic passes, telling a website that the user has already signed in. As a result, an attacker may be able to access someone else\u2019s account without entering a password or a two-factor authentication code, putting messages, documents, delivery addresses, order histories and other confidential information at risk.<\/p>\n

Loss of files on home devices<\/h3>\n

If you have network-attached storage (NAS) or a video surveillance system at home that uses a vulnerable PHP version, it may also be at risk. Depending on what level of access they gain, attackers could potentially copy, delete or encrypt files they can access.<\/p>\n

Malware infection<\/h3>\n

If an attacker gains access to a vulnerable website, they can use it in virtually any way they want: trick visitors into downloading a malicious file or clicking on a phishing link, display dangerous instructions, replace payment forms or login pages with malicious ones \u2014 and the list just goes on. As a result, someone visiting a legitimate website could not only lose access to their account, but also lose money or accidentally infect their device with malware.<\/p>\n

Below are examples of services directly affected by the vulnerabilities.<\/p>\n

Which services are affected by the PHP vulnerabilities<\/h2>\n

Jeedom<\/h3>\n

Jeedom is a smart-home platform that lets users control lighting, sensors, heating, blinds and home IoT devices. Attackers could abuse this in many ways: they could disable the alarm, track when the homeowner is away, access video from the door intercom, and more.<\/p>\n

The developers confirmed that the new vulnerability affects their application and have already released an emergency update<\/a>, Jeedom 4.6.2. Users need to run the update twice<\/em> for it to work. The developers say a fully fixed version for home users will be released in the coming days.<\/p>\n

Websites we use every day<\/h3>\n

As mentioned above, PHP is used by roughly 70% of websites. This does not mean every one of them is vulnerable: it depends on the PHP version in use and whether the site owners have already updated it. Many government websites in Europe have already suspended operations<\/a> because of the new vulnerability.<\/p>\n

Unfortunately, a website may still be vulnerable even if it appears to be working normally. An attacker could potentially take control of any legitimate website whose server hasn\u2019t been patched yet. They could fake payment or login pages, host malicious files, or persuade users to download an \u201curgent update\u201d that is actually malware.<\/p>\n

Ordinary users have no reliable way to check whether such instructions or files are safe, so be sure to use reliable anti-phishing and antivirus protection<\/a>. If you suspect that your data may have been stolen, check the active sessions in your account settings. If you spot suspicious activity or devices you don\u2019t recognize, sign out of all active sessions and change your password. Use a password manager<\/a>\u00a0<\/strong>\u2014 it can generate a truly strong, unique password that you won\u2019t have to memorize yourself.<\/p>\n

Computer games<\/h3>\n

Bad news for gamers: some video games whose servers use PHP are also at risk. If you don\u2019t want attackers to get hold of your accounts, be sure to update the passwords for your gaming platforms, stores and accounts.<\/p>\n

To buy time for updates, some developers temporarily took their services offline. Final Fantasy XIV<\/em>, Pokemon Champions<\/em>, games from Bandai Namco Entertainment, Uma Musume: Pretty Derby<\/em>, Granblue Fantasy<\/em>, Shadowverse: Worlds Beyond<\/em> and many others went into emergency maintenance. Nintendo Switch Online and the GOG and Steam stores were also affected<\/a>.<\/p>\n

Unfortunately, there have also been more drastic consequences. Yesterday, the developers of World Quest<\/em> announced<\/a> that the game would shut down completely after 15 years: it relied on outdated infrastructure that would have been extremely difficult and costly to fix. For the same reason, the mobile game Please Save My Pandemonium!<\/em> shut down after more than ten years of operation.<\/p>\n

Home network-attached storage (NAS)<\/h3>\n

\u201cHome clouds\u201d have become popular in recent years for good reason: many users prefer to keep backups of their data at home rather than online. A number of companies make NAS devices, and at least three \u2014 QNAP, Synology and ASUSTOR \u2014 have said the vulnerabilities affect their products. An update has also been released for Unraid<\/em>, an operating system for home servers, network storage and media servers.<\/p>\n

QNAP<\/h4>\n

The manufacturer confirmed that the vulnerabilities affect several versions of its NAS operating systems \u2014 QTS<\/em> and QuTS hero<\/em> \u2014 as well as applications including QuMagie<\/em>, Note Station 3<\/em> and certain versions of QVR Surveillance<\/em>. A successful attack could put photos, documents, notes and camera recordings at risk.<\/p>\n

At the time of publication, QNAP is still preparing updates, so the main priority is to temporarily disconnect the NAS from the internet. QNAP recommends<\/a> disabling port forwarding on the router, preventing the NAS from automatically opening ports, and allowing access to the management panel only from the home network or through a VPN<\/a>.<\/p>\n

Synology<\/h4>\n

Both vulnerabilities have been officially confirmed<\/a> in PHP packages 7.3, 7.4 and 8.0\u20138.4, as well as in Mail Station<\/em> and Synology Calendar<\/em>. Fixes have already been released for PHP starting from version 7.4, as well as for Mail Station<\/em> and Synology Calendar<\/em>. PHP 7.3 won\u2019t be fixed. The company separately notes that the PHP component built into its operating system cannot be reached from outside the device, so the risk of attack is very low.<\/p>\n

ASUSTOR<\/h4>\n

ASUSTOR has also officially confirmed both vulnerabilities<\/a> and immediately removed PHP 7, 7.3, 7.4 and 8.1 packages from App Central. The company recommends immediately backing up your data, removing older PHP packages, and using PHP 8.3 or 8.4.<\/p>\n

Unraid<\/h4>\n

In today\u2019s operating-system update<\/a>, PHP was upgraded to version 8.4.27 with fixes for the vulnerabilities. The developers recommend that all users update to Unraid 7.3.4. Containers with their own PHP installation must be updated separately: the new PHP version in the operating system doesn\u2019t replace PHP inside containers.<\/p>\n

At the time of publication, we had not found public confirmation from other major manufacturers, such as TerraMaster, UGREEN, Buffalo or Western Digital, that their devices are affected by these vulnerabilities \u2014 only user discussions on forums.<\/p>\n

But the fact that only some NAS manufacturers have confirmed the problem so far doesn\u2019t guarantee that your devices are safe \u2014 especially if they are fairly old or come from a lesser-known or defunct manufacturer. In that case, first disconnect the devices from the internet while keeping them accessible only on the local network, and then investigate whether they are vulnerable.<\/p>\n

Nextcloud cloud storage<\/h4>\n

Nextcloud is a free, open-source platform for creating your own cloud storage, serving as an alternative to Google Drive, Dropbox, and Microsoft OneDrive. It lets you store and synchronize files across devices, share them with other users, and work with documents, photos, calendars and contacts. The data can be stored on your own server or NAS rather than on a third-party company\u2019s servers.<\/p>\n

If you store important data in Nextcloud, check how your cloud instance is configured. If you use Nextcloud All-in-One<\/em>, update to version 14.4.1<\/a>, where the vulnerability has already been fixed.<\/p>\n

If your Nextcloud installation is configured differently, you need to update PHP yourself on the device or server.<\/p>\n

How to protect your devices and data<\/h2>\n