Genians found 96% of PHP-running devices on internal networks were vulnerable, with outdated software and poorly monitored appliances leaving organisations exposed to attacks and lateral movement.
The risk from the newly disclosed PHP2Shell flaw may be greater inside corporate networks than on exposed public servers, according to a review of device-identification data by South Korean security firm Genians. The company said its analysis of assets seen by its cloud network access control platform found that 96% of PHP-running devices on internal networks were vulnerable, underlining how hidden infrastructure can become an easier entry point for attackers than internet-facing systems. The issue has gained urgency after the US Cybersecurity and Infrastructure Security Agency added PHP2Shell to its Known Exploited Vulnerabilities list, indicating active abuse in the wild. The report was inspired by the recent eToday article on the flaw and its implications for private networks.
Genians said most of the exposed devices were running outdated software. Of the vulnerable systems it identified, 78% were on PHP 8.1 or earlier, while 48% were still using PHP 5.x or earlier, a line that has been unsupported since 2018. Traditional servers accounted for only 24% of the affected equipment. The rest included CCTV and video storage systems, security products, RFID readers and other internet-connected devices, plus a substantial share of assets the company could not classify at all. That distribution matters because it suggests many organisations have PHP embedded in products that are not usually treated as web servers and may therefore escape routine patch management.
Another concern is visibility. Genians said 89% of the identified devices sat in private IP ranges that are not reachable through ordinary external scanning. In practice, that means administrators may not even know PHP is running on some appliances until a vulnerability is already being exploited. The company warned that relying on external scanning tools and manual IP checks leaves blind spots in internal networks. Its recommendation is to establish full asset visibility first, then verify whether PHP is present and whether it is patched, rather than assuming only conventional servers need review.
The consequences can extend beyond the initial compromise. Attackers who gain control of an internal device may use it as a foothold for lateral movement or as a launchpad for ransomware. That risk is especially serious for NAS units, which are often used as backup storage. If those systems are compromised, recovery copies can be damaged alongside primary data. Synology has already issued security updates after confirming that PHP2Shell affects some PHP-based applications in its products, including WordPress, Web Station and Mail Station. It also published fixed package versions for affected releases of its DiskStation Manager operating system.
Korea Internet & Security Agency has separately urged users of affected Synology Calendar, Mail Station and PHP packages to install the latest available updates. Synology’s advisory classifies PHP2Shell as critical, though it says the built-in PHP shipped with its operating system is not externally exposed and carries very low exploitation risk. Genians’ CTO, Kim Gye-yeon, said internal managed devices often require deeper inspection of web-console responses and built-in components to determine whether PHP is actually present, and argued that unsupported equipment should be isolated from the network until it can be replaced.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
