TrainingSmart Building trainingTunis · Sfax · Sousse · Djerba · Upcoming datesView the calendar
ExaBuilding
BMS

PHP2Shell: a critical flaw that also affects connected buildings

Oussama Ben JemiaOussama Ben JemiaPublished on October 23, 2026

*Who it’s for: *Building operators and owners, integrators, design offices and IT managers.

Updated on 22 October 2026. The situation is evolving: we will update this article if official advisories change.

On 21 October 2026, the PHP team released emergency fixes for two critical flaws, nicknamed “PHP2Shell”. This language powers a large share of the world’s websites, but also many interfaces of technical equipment. That is why this alert is not only about websites.

In brief (as of 22 October 2026)

  • Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, can in some configurations allow an attacker to take control of a server remotely, without a password.
  • The problem is global: PHP is used everywhere, and cybersecurity agencies in several countries have issued alerts, including CERT-FR in France and the NCSC in the United Kingdom.
  • The NCSC also asks organisations to monitor manufacturers’ updates for equipment that bundles PHP. Technical building installations are among the systems to check.

A global alert in 48 hours

Details of the two flaws were due to be made public in a coordinated way on 22 October. According to the security company watchTowr, they leaked on social media as early as 20 October, before the fixes were even released. The PHP team therefore published its updates in a hurry on 21 October, after sharing them in advance with Linux distributions and long-term support vendors.

PHP is not just another piece of software: it runs on millions of servers around the world. Within hours, the alert was relayed by cybersecurity agencies in several countries. In the United Kingdom, the NCSC even points to an inventory of affected products maintained by its Dutch counterpart, NCSC-NL.

What we know (as of 22 October 2026)

Confirmed by official sources:

  • PHP has fixed two critical vulnerabilities, rated 9.2 out of 10. They can allow remote code execution without authentication.
  • The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • The PHP project no longer maintains versions 8.1 and older. Given the severity of the flaws, its security team has nevertheless published minimal fixes for versions 7.4, 8.0 and 8.1, and some distributions and vendors offer backported fixes.
  • According to the PHP team, the risk concerns all installations that serve web requests, and it is highest with Apache’s mod_php module.
  • CERT-FR says it is aware of proofs of concept. The UK NCSC recommends updating without delay and, if no mitigation can be applied quickly, considering taking the system offline.

Reported by a security company:

  • watchTowr says it has observed exploitation attempts on its network of traps (honeypots) since 21 October. These observations do not, at this stage, concern confirmed incidents in connected buildings.

What remains to be confirmed

  • The real scale of the attacks: as of 22 October, neither CERT-FR nor the NCSC reports active exploitation, and the US agency CISA had not added these flaws to its catalogue of exploited vulnerabilities, according to watchTowr, which does not prove that there are no attacks.
  • The list of affected equipment and software, which manufacturers are currently drawing up.

Why are connected buildings concerned?

PHP is best known as the language behind many websites. But it is also found elsewhere.

Many pieces of technical equipment have an embedded web interface, accessible from a browser:

  • BMS supervisors and visualisation servers;
  • Protocol gateways;
  • Routers, firewalls and Wi-Fi access points;
  • Storage servers (NAS) and some recorders.

This list does not mean that this equipment is vulnerable. Depending on the manufacturer, these interfaces may rely on PHP, on another language or on a specific web server. Only the manufacturer can say whether its equipment uses PHP, and which version. Conversely, not knowing whether a device uses PHP does not prove that it is protected.

This is exactly what the UK NCSC points out. It asks organisations to monitor updates from third-party vendors, “including for appliances and services that may bundle PHP”.

The major manufacturers have started their checks. Cisco, for example, is examining a long list of its products (networking, security, Wi-Fi, telephony). As of 22 October, none was known to be affected, and Cisco said it was not aware of any malicious use of these flaws.

The real trap: equipment that is never updated

On a standard web server, the answer is simple: install the fixed version of PHP.

For technical equipment, it is different. The software is built into the manufacturer’s firmware. The operator cannot update PHP themselves: they have to wait for, then install, an update supplied by the manufacturer.

Yet older equipment often embeds older versions of PHP, and CERT-FR points out that versions 5.x, 7.x, 8.0.x and 8.1.x are no longer maintained. Fixes exist for some of them, but the manufacturer still has to include them in a firmware update.

The scenario is comparable to the recent incident involving refrigeration controllers. According to Danfoss, most of the affected units were older products that no longer received updates, and CERT-FR pointed out that their interfaces should not have been exposed on the Internet. We covered this in detail in our article on cybersecurity in connected buildings.

What to do right now?

  1. Inventory web interfaces. List the technical equipment that has an interface accessible from a browser, and check which ones can be reached from the Internet;
  2. Expose nothing directly on the Internet. CERT-FR recommends isolating the affected equipment. Remote access must go through a VPN or filtered access, never through an open interface. These measures reduce exposure, but do not fix the flaw;
  3. Ask manufacturers and integrators. Ask whether the equipment uses PHP, which version, and whether a fix is planned;
  4. Apply updates as soon as they are released. For servers you manage yourself, move to a fixed version of PHP. The PHP team states that its temporary mitigations do not make an installation safe: they do not replace the update;
  5. Look for signs of compromise. Before fixing an exposed system, the NCSC advises checking that it has not already been compromised, for example by a backdoor installed by an attacker;
  6. Disconnect as a last resort. If an exposed system can be neither fixed nor protected quickly, the NCSC recommends considering taking it offline.

Frequently asked questions

Is my building concerned if I don’t have a website?

Possibly. The question is not whether you have a website, but whether your technical equipment has a PHP-based web interface. Only the manufacturer of each device can confirm this.

How can I find out whether a device uses PHP?

By checking the manufacturer’s security advisories, or by asking them directly, with the exact product reference and firmware version. Your integrator can help you carry out this inventory.

Should equipment be switched off right away?

Not necessarily. The priority is to check that it cannot be reached directly from the Internet. Disconnection is only advised as a last resort, for an exposed system that can be neither fixed nor protected quickly.

Conclusion: a lesson that goes beyond PHP

This flaw will be fixed, like others before it. But it is a reminder of a reality: a connected building contains dozens of pieces of software that nobody sees, and you need to know they exist in order to protect them.

The installations that hold up best are those designed for this from the outset: an up-to-date inventory, segmented networks, controlled remote access and an update plan for the entire service life of the equipment.

A smart building must not only be well integrated. It must also be possible to maintain and secure it over time.

At ExaBuilding, this requirement is part of every project, from the audit of existing installations to the design and integration of new systems.

Would you like to know whether your technical installations are exposed? Talk to an expert

Note: this article reflects the situation as of 22 October 2026, based on the official advisories available on that date. For each device, the manufacturer’s security advisory prevails.

Sources

Official sources

Manufacturer

Security company

Oussama Ben Jemia

Oussama Ben Jemia

Related training : Integration & Interoperability of Smart Building SystemsRelated training : IP Networks for Smart BuildingRelated training : Smart Building Project Design & Engineering
Related expertise : Smart Building Design & IntegrationRelated expertise : Smart Building Audit