PHP2Shell is a security vulnerability that can allow attackers to execute PHP code remotely under certain conditions. By sending specially crafted HTTP POST requests to a vulnerable application, an attacker may be able to execute commands on the affected server without needing valid login credentials. The potential impact goes beyond websites and web servers. Many security devices, including IP cameras and Network Video Recorders (NVRs), run embedded software and provide web-based interfaces for configuration and remote access. If these devices contain a vulnerable PHP application or a related exposed service, they could also be at risk.
So, what could happen if a security camera or NVR is compromised by this type of vulnerability?
In this article, I’ll explain what PHP2Shell is and how it can affect security camera devices. I’ll break down the issue in simple terms to help you understand the potential risks and what you can do to protect your cameras.
What Is PHP2Shell? And How Does It Work?
PHP2Shell refers to two critical security vulnerabilities in PHP that could allow attackers to execute code remotely without authentication on vulnerable systems. Disclosed on October 21, 2026, these vulnerabilities have raised concerns about the security of web servers running PHP.
PHP is a widely used programming language for running websites and web applications.
PHP2Shell isn’t just a bug in a specific plugin or theme; rather, it’s related to a vulnerability in the PHP engine itself.
Simply put, the attack process can be described as follows:
- The attacker sent a specific request – HTTP requests crafted to exploit the PHP vulnerability.
- PHP is in a vulnerable state – Memory management flaws can be exploited.
- Malicious code may be executed – Attackers may gain access with the privileges of the affected PHP process.
What Is the Impact of PHP Vulnerabilities on Security Camera Devices?
If the attack is successful, the potential consequences include:
- Server Takeover: Attackers may be able to execute commands on the server without logging in through the usual authentication page.
- Data Theft: Sensitive information, such as passwords, authentication tokens, or API keys accessible to the affected process, could be exposed.
- System Modification: Attackers may be able to modify files, compromise websites, or install malicious software.
- Service Disruption: The server or application may experience operational disruptions or become unavailable.
IP cameras and NVRs could be at risk if they run a vulnerable version of PHP and expose an exploitable service. However, not all cameras use PHP, so it would be incorrect to assume that every CCTV camera is affected.
For example, a camera that only runs firmware based on other components—without the vulnerable PHP—is not automatically affected by PHP2Shell.
Are All Security Cameras and NVRs Affected?
No. PHP2Shell is a vulnerability in the PHP runtime environment; it is not a vulnerability that automatically affects all IP cameras or NVRs. The risk primarily applies to systems running a vulnerable version of PHP that process web requests capable of triggering the vulnerability.
This means that cameras that only provide web services based on other technologies are not automatically affected. We need to know the operating system, the software, the PHP version (if used), and the exposed services.
How to reduce risk?
- Keep Software Updated: Install official firmware updates and security patches whenever they become available.
- Restrict Internet Access: Avoid exposing camera and NVR administration interfaces directly to the internet.
- Use a Separate Network: If possible, isolate your cameras and NVRs from your personal devices and primary network.
- Check for Suspicious Activity: Review system logs, user accounts, configuration settings, and network activity for signs of unauthorized access.
- Change Credentials if Necessary: If a device is suspected of being compromised, change its passwords as part of a secure recovery process.
PHP security updates addressing these vulnerabilities include versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Systems running older or unsupported versions of PHP should receive particular attention.
PHP2Shell is a vulnerability in the PHP core that could expose vulnerable servers to serious security threats. For security camera devices, the first step is to determine whether the device actually uses PHP and whether its PHP version or related components are affected.
Hikvision and Synology Have Reported Vulnerabilities in Their Devices and How to Address Them
From what I’ve seen, Hikvision seems to be taking steps to address this PHP vulnerability. They’ve also shared a list of products that may be affected.
Affected Versions and fixes.
| Product Model | Affected Versions Firmware | Fix Instructions |
|---|---|---|
| DS-A71024/48/72R DS-A80624/48S DS-A81016/24/36/48/72S DS-A72024/48/72R DS-A80316/24/36/48S DS-A83024S DS-A82024S DS-A82024/48D | Version 2.3.9-8 and earlier | Version V2.3.4-2 and later support direct upgrades. If you’re running a version earlier than V2.3.4-2, you’ll need to upgrade to V2.3.4-2 first. Click here to download the upgrade package. |
After installing this patch, the PHP-Web service will be disabled by default, but the device’s storage functions will continue to work normally. The PHP version upgrade patch is still being tested. Keep an eye on this page for the latest patch updates. Some products require service center assistance.
Products That Require Service Center Assistance.
| Product Model | Affected Versions | Remediation Instructions |
|---|---|---|
| DS-A71024/48R-CVS DS-A81016S-CVS DS-A72024/48/72R-CVS DS-A72024/48/72RH-CVS | Version 1.1.4 and earlier | For assistance, contact your local Hikvision office. Click here to find contact information. |
Synology has rolled out PHP security updates for DiskStation Manager (DSM) 7.4, DSM 7.3, and DSM 7.2, which has reached end of life. If you’re using any affected packages, it’s best to update PHP through Package Center as soon as possible. Once the update is complete, dependent packages will restart automatically, and the vulnerability will be fixed.
If your system is running a DSM version older than 7.2, Synology recommends temporarily disabling any affected packages to reduce the risk until you can upgrade to a patched version.
DSM also includes PHP components used for internal system operations.
By design, these components don’t include any externally accessible modules, so they don’t expose an attack surface to outside threats. Synology PSIRT has assessed the risk as minimal and plans to include a patch in the next DSM release to ensure consistent vulnerability scan results and maintain compliance.
For more details and the latest updates, check out Synology’s Security Advisory Synology-SA-26:14.
Conclusion
The PHP2Shell vulnerability is a good reminder that security cameras and surveillance systems aren’t always as secure as they might seem. If a device runs a vulnerable version of PHP, attackers could potentially exploit it to gain unauthorized access or execute malicious code, depending on the device’s configuration and exposure.
In my opinion, PHP2Shell won’t directly affect security devices that don’t use PHP code in their underlying systems, such as their firmware.
From what I’ve seen, vendors like Hikvision and Synology are taking steps to address this issue through security updates, patches, and mitigation measures. However, fixing the vulnerability isn’t always as simple as installing an update. Some devices may require manual upgrades or assistance from an authorized service center, while others may need certain services to be disabled temporarily.