Genians: 96% of internal PHP devices exposed to PHP2Shell
Genians analysed data from its cloud NAC platform and found most vulnerable devices ran unsupported PHP versions, with 48% on PHP 5.x or older.
Genians said on October 30, 2026 that 96% of devices running PHP on corporate internal networks were exposed to the PHP2Shell vulnerability, based on an analysis of device identification data collected by its cloud network access control platform. The company's announcement was reported by digitaltoday.co.kr.
PHP2Shell is a vulnerability that allows an attacker to execute malicious code remotely without separate authentication.
Most of the affected devices were running outdated software. Genians said 78% ran PHP 8.1 or older, versions no longer officially supported, and 48% ran PHP 5.x or older, whose support ended in 2018.
By device type, general servers accounted for 24%, CCTV and video recorders and security solutions for 20%, IoT devices such as RFID readers for 17%, and unidentified assets for 27%. Genians also found that 89% of the identified devices sat on private IP ranges that are hard to reach from the external internet.
Unpatched systems inside the perimeter
The findings follow action by the U.S. Cybersecurity and Infrastructure Security Agency, which added two related vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities list on October 26.
Kim Gye-yeon, head of Genians' US corporation and its CTO, said devices without official patches or awaiting patch distribution should have network access blocked or isolated until they are replaced.
Quick answers
What is PHP2Shell?
It is a vulnerability that allows an attacker to execute malicious code remotely without separate authentication.
How many PHP devices on internal networks were affected, according to Genians?
Genians found that 96% of devices running PHP on internal networks were exposed to the vulnerability.