How new PHP vulnerabilities threaten home users | Kaspersky official blog

On October 21, two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed, affecting nearly 70% of websites worldwide. But if you think this’s only an admins’ headache, read on: we explain why your photos, music, archives, games, NAS and smart-home systems may be at risk, and how to protect your data and devices.

Editorial Team

October 22, 2026

Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services:CVE-2026-109618andCVE-2026-109619. Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell.

The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day.

We’ve alreadycovered the technical details of these vulnerabilitiesandexplained what companies and server administrators should do. You may have safely skipped that news because you don’t run any servers — but unfortunately, the issue is not limited to businesses.

Nearly 70% of websites run on PHP, including services we use every day: wikis, online stores, smart devices with web interfaces, home network-attached storage (NAS), smart-home controllers, and much more.

Today, we explain how these vulnerabilities could affect you personally and what you can do to reduce the risks.

The vulnerability allows an attacker to steal authentication tokens from server memory. These tokens essentially act like electronic passes — telling a website that the user has already signed in. As a result, an attacker may be able to access someone else’s account without entering a password or two-factor authentication code, putting messages, documents, delivery addresses, order histories, and other confidential information at risk.

If you have network-attached storage (NAS) or a video surveillance system at home that uses a vulnerable PHP version, it may also be at risk. Depending on what level of access they gain, attackers could potentially copy, delete or encrypt files they can access.

If an attacker gains access to a vulnerable website, they can use it in virtually any way they want: trick visitors into downloading a malicious file or clicking on a phishing link, display dangerous instructions, replace payment forms or login pages with malicious ones — the list goes on and on. As a result, someone visiting a legitimate website could not only lose access to their account, but also lose money or accidentally infect their device with malware.

Below are examples of services directly affected by the vulnerabilities.

Jeedom is a smart-home platform that lets users control lighting, sensors, heating, blinds and home IoT devices. Attackers could abuse this in many ways: they could disable the alarm, track when the homeowner is away, access video from the door intercom, and more.

The developers confirmed that the new vulnerability affects their application, and have alreadyreleased an emergency update— Jeedom 4.6.2. Users need to run the updatetwicefor it to work. The developers say a fully fixed version for home users will be released in the coming days.

As mentioned above, PHP is used by roughly 70% of websites. This doesn’t mean every one of them is vulnerable: it depends on the PHP version in use and whether the site owners have already updated it. Many government websites in Europe have alreadysuspended operationsbecause of the new vulnerability.

Unfortunately, a website may still be vulnerable even if it appears to be working normally. An attacker could potentially take control of any legitimate website whose server hasn’t been patched yet. They could fake payment or login pages, host malicious files, or persuade users to download an “urgent update” that is actually malware.

Ordinary users have no reliable way to check whether such instructions or files are safe, so be sure to usereliable anti-phishing and antivirus protection. If you suspect that your data may have been stolen, check the active sessions in your account settings. If you spot suspicious activity or devices you don’t recognize, sign out of all active sessions and change your password. Use apassword manager— it can generate a truly strong, unique password that you won’t have to memorize yourself.

Bad news for gamers: some video games whose servers use PHP are also at risk. If you don’t want attackers to get hold of your accounts, be sure to update the passwords for your gaming platforms, stores and accounts.

To buy time for updates, some developers temporarily took their services offline.Final Fantasy XIV,Pokemon Champions, games from Bandai Namco Entertainment,Uma Musume: Pretty Derby,Granblue Fantasy,Shadowverse: Worlds Beyond,and many others went into emergency maintenance. Nintendo Switch Online and the GOG and Steam stores were alsoaffected.

Unfortunately, there’ve also been more drastic consequences. Yesterday, the developers ofWorld Questannouncedthat the game would shut down permanently after 15 years: it relied on outdated infrastructure that would have been extremely difficult and costly to fix. For the same reason, the mobile gamePlease Save My Pandemonium!shut down after more than ten years of operation.

“Home clouds” have become popular in recent years for good reason: many users prefer to keep backups of their data at home rather than online. A number of companies make NAS devices, and at least three — QNAP, Synology and ASUSTOR — have said the vulnerabilities affect their products. An update has also been released forUnraid, an operating system for home servers, network storage and media servers.

The manufacturer confirmed that the vulnerabilities affect several versions of its NAS operating systems —QTSandQuTS hero— as well as applications includingQuMagie,Note Station 3and certain versions ofQVR Surveillance. A successful attack could put photos, documents, notes and camera recordings at risk.

At the time of publication of this blogpost, QNAP is still preparing updates, so the main priority is to temporarily disconnect NAS from the internet. QNAPrecommendsdisabling port forwarding on the router — to prevent NAS from automatically opening ports — and allowing access to the management panel only from the home network orthrough a VPN.

Both vulnerabilities have beenofficially confirmedin PHP packages 7.3, 7.4, and 8.0–8.4, as well as inMail StationandSynology Calendar. Fixes have already been released for PHP, starting from version 7.4, as well as forMail StationandSynology Calendar. PHP 7.3 won’t be fixed. The company separately notes that the PHP component built into its operating system cannot be reached from outside the device, so the risk of attack is very low.

ASUSTOR alsoofficially confirmed both vulnerabilities, and immediately removed PHP 7, 7.3, 7.4, and 8.1 packages from App Central. The company recommends immediately backing up your data, removing older PHP packages, and using PHP 8.3 or 8.4.

Intoday’s operating-system update, PHP was upgraded to version 8.4.27 with fixes for the vulnerabilities. The developers recommend that all users update to Unraid 7.3.4. Containers with their own PHP installation must be updated separately: the new PHP version in the operating system doesn’t replace PHP inside containers.

At the time of publication, we haven’t found public confirmation from other major manufacturers (such as TerraMaster, UGREEN, Buffalo, or Western Digital) that their devices are affected by these vulnerabilities — only user discussions on forums.

But the fact that only some NAS manufacturers have confirmed the problem so far doesn’t guarantee that your devices are safe — especially if they’re fairly old or come from a lesser-known or defunct manufacturer. In that case, first disconnect the devices from the internet while keeping them accessible only on the local network, and then investigate whether they’re vulnerable.

Nextcloud is a free, open-source platform for creating your own cloud storage, serving as an alternative to Google Drive, Dropbox, and Microsoft OneDrive. It lets you store and synchronize files across devices, share them with other users, and work with documents, photos, calendars and contacts. The data can be stored on your own server or NAS rather than on a third-party company’s servers.

If you store important data in Nextcloud, check how your cloud instance is configured. If you useNextcloud All-in-One,update to version 14.4.1where the vulnerability has already been fixed.

If your Nextcloud installation is configured differently, you need to update PHP yourself on the device or server.

What other risks can your home devices face? Read our articles:

PHP developers have released patches for two critical vulnerabilities that could allow an attacker to remotely execute arbitrary code on the server without authentication.

PHP developers have released patches for two critical vulnerabilities that could allow an attacker to remotely execute arbitrary code on the server without authentication.

Editorial Team

October 21, 2026

We break down how to use ebooks safely and which rules to follow when searching for books online, so you don’t fall victim to scammers

We break down how to use ebooks safely and which rules to follow when searching for books online, so you don’t fall victim to scammers

Editorial Team

October 30, 2026

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

Stan Kaminsky

October 28, 2026

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

Lama Saqqour

October 15, 2026

University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.

University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.

Maxim Baybarin

September 30, 2026