We analyzed this claim: is it true that
Palo Alto Networks expanded PHP2Shell detection coverage and QNAP released additional security-fixed firmware on October 24, giving affected operators new ways to verify protection?
Palo Alto's October 24 advisory revision and QNAP's dated firmware announcements establish material new defensive developments; neither proves every affected system is patched or uncompromised
New PHP2Shell Fixes Still Leave Websites Exposed
Fresh updates from device makers plug key gaps, but full protection remains unfinished.
In a nutshell
Fixing a severe security flaw in PHP, the programming language behind much of the web, requires far more than one software update. Fresh releases from storage maker QNAP and cybersecurity firm Palo Alto Networks help block attacks, but neither company has delivered complete repairs for all affected products. True protection requires website owners to inspect their specific hardware, install exact firmware updates and check past records to ensure intruders did not break in before the patches arrived.
Highlights
- Security researchers discovered an attack path in PHP on August 11, 2026, leading to emergency core fixes on October 21.
- QNAP released firmware updates on October 24 for several storage systems, but left applications like Note Station 3 awaiting fixes.
- Palo Alto Networks updated its firewall detection rules on October 24, while permanent software repairs remain scheduled for October 26 to 30.
- QNAP firmware updates do not automatically repair PHP software running inside isolated containers or third-party applications.
From the Editor’s Diary
A green security shield on a dashboard shows that a safety rule is turned on, not that the underlying system is repaired. In modern web infrastructure, safety depends on confirming each layer of software individually.
Who's involved
QNAP Systems
Taiwanese maker of network storage devices and software used to host files and web applications
goal → Deliver repaired software for its devices and shield customer equipment from attack
Palo Alto Networks
American cybersecurity company that makes firewalls and tools that spot online threats
goal → Improve defenses against emerging attack methods and build permanent software repairs
PHP Foundation and PHP Security Team
Groups that maintain and secure the PHP programming language
goal → Repair the core flaws and guide software distributors on fixing their systems
Website and infrastructure operators
Companies and administrators running websites, servers and network equipment
goal → Verify their systems are repaired, shielded from attack and checked for prior break-ins
In short
Installing an emergency software fix does not mean every system running a website is safe. That is the core finding from new vendor updates addressing PHP2Shell, a pair of severe security weaknesses in PHP, the programming language that powers countless websites. The flaws let outsiders take control of systems remotely without needing a password. While emergency repairs for PHP arrived on October 21, securing every piece of hardware and software that relies on the language takes a far wider effort.
Website operators will need to run detailed checks on their exact equipment rather than assume a single patch solved the problem.
Whether that will happen smoothly across the web remains uncertain, because many devices still lack finished repairs and different technologies require fundamentally different defenses.
Previously in this story
Why Updating PHP Does Not Prove a Site Is Safe
24 October 2026Applying an emergency security patch does not guarantee that a website is protected or clean.
How it unfolded
Researchers Find an Attack Path in Web Software
On August 11, 2026, security researcher Ryan Austin of the firm Calif alerted PHP maintainers to a critical flaw that let attackers run code without logging in. The research lab OpenAI reported the same underlying flaw on the same day. Developers had spotted clues of memory-handling trouble during a 2024 security review, but the 2026 findings proved that hackers could actually exploit it. Further research by the cloud security firm Wiz helped prompt emergency fixes.
Hardware Makers Issue Updates but Gaps Persist
On October 24, makers of network hardware released new protections, shifting defense from core code to real-world gear. QNAP announced updated operating software for its storage devices, publishing fixes for versions including QTS 5.2.11.3661 and QuTS hero h6.0.2.3656. Yet several of its applications, including Note Station 3 and surveillance tools, still await fixes, meaning hardware can remain exposed even after an update. On the same day, Palo Alto Networks updated its security advice, adding traffic-filtering rules to spot attacks. Filtering can block incoming threats, but it does not fix vulnerable underlying software on the company's firewall operating system, which still awaits permanent repairs. For website owners, showing real safety now requires verifying exact software versions and checking network logs for past intrusion.
Where things stand
By October 25, 2026, defensive progress was clear, but genuine safety remained uneven. QNAP has released fixes for several system families, but its updates do not cover custom app containers or third-party tools, which operators must check on their own.
Palo Alto Networks reported no known attacks on its own products, but permanent repairs for its PAN-OS software are not expected until late October. To confirm safety, shared-hosting clients must verify that their providers updated the PHP software. Private server administrators must confirm their software was updated, restarted and audited for suspicious traffic dating back to mid-October. Appliance operators must check firmware versions and inspection rules. The remaining questions are when final fixes will arrive and whether detailed reviews will turn up hidden intrusions.
PHP2Shell: the PHP security crisis
PHP emergency website patch faces unproven bypass fears
21 October 2026Online warnings claimed that a new fix for the programming language powering millions of websites had failed, but technical evidence shows no broken security update.
PHP fixes flaws rated 9.2 as exploit leaks drive early attacks
21 October 2026Millions of web servers face takeover risks after flaws leaked before fixes arrived.
Sources
- QNAP Community, QTS 5.2.11 release announcement
- QNAP Community, QuTS hero h6.0.2 release announcement