CMMC guide
PHP2Shell and CMMC: what to do about your firewall and NAS this week
On October 21, 2026 the PHP project fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. An attacker can run code on an affected server with no login. Most coverage has focused on websites. For a defense supplier the bigger exposure is the equipment that protects your CUI environment: firewalls, VPN gateways and backup NAS devices whose management interfaces are built on PHP. Under CMMC Level 2 those devices are Security Protection Assets. They are in your assessment scope, and so are their configurations and logs.
What is known so far?
- Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source backports exist for 7.4, 8.0 and 8.1.
- Attacks started early. Amazon's honeypot recorded an exploitation attempt on October 17, four days before disclosure, according to Help Net Security. Cloudflare and Patchstack reported early attacks around release day.
- Government advice: the UK NCSC says patch now, or take a system offline until it can be patched.
Which appliances are affected?
Vendor status changes daily, so check the vendor's own advisory before acting. When we checked on October 28:
- Palo Alto Networks: all PAN-OS and Panorama versions affected; no fixed release confirmed at last report.
- QNAP: QTS and QuTS hero affected under advisory QSA-26-18; no fixed release at last check. QNAP says take the device off the internet.
- Synology: fixed PHP packages through Package Center under Synology-SA-26:14; PHP 7.3 will not be fixed.
- Fortinet: FortiOS and FortiManager reported not impacted.
- Cisco: more than 30 products under review, none confirmed affected at last report.
The Dutch NCSC keeps a public vendor status list on GitHub. Use it as a starting point, then confirm against the vendor's page.
Where does this land in your controls?
- Vulnerability scanning (RA.L2-3.11.2): scan when new vulnerabilities affecting your systems are identified, not only on your normal schedule. Run an out of cycle scan of your in scope devices now and keep the dated report.
- Vulnerability remediation (RA.L2-3.11.3): remediate in line with your risk assessment. Record the risk call for each affected device, especially any with no fix yet.
- Flaw remediation (SI.L1-3.14.1): identify, report and correct flaws in a timely manner. A dated ticket per device, opened this week and closed when the vendor fix is applied, is the evidence.
- Incident reporting (IR.L2-3.6.2): if you find signs of compromise, DFARS 252.204-7012 requires a report to DoD within 72 hours of discovering a cyber incident affecting covered defense information.
What should you do this week?
- Inventory. List every firewall, VPN, NAS and hosting panel in your CUI boundary, with make, model and version. Your asset inventory should already have this.
- Exposure. Confirm no management interface is reachable from the internet. Restrict it to named internal addresses.
- Patch. Apply the vendor fix where one exists, then restart. Where none exists, take the interface off the internet and document the compensating control.
- Hunt. Review device and firewall logs from October 17 onward for unexpected requests, crashes or new admin accounts. Application logs may show little, because the flaw sits below the application layer.
- Record. Ticket, scan report, change record and risk decision for each device. That is your evidence chain.
Why does it matter with Phase 2 paused?
The C3PAO phase is suspended, but NIST SP 800-171, DFARS 252.204-7012, your SPRS score and the annual affirmation all still stand. With no third party assessor in between, the senior official's signature is the main assurance the government gets. A dated record that you found and fixed a critical flaw in an in scope device is what backs that signature.
If you want a second set of eyes on which devices are in scope and what to log, our CMMC Level 2 gap assessment includes scoping, or talk to us.
Sources
Questions contractors ask
FAQOur firewall vendor says it is not affected. Do we need to do anything?
Save the vendor statement with the date you read it, and note it in your flaw remediation record. That is your evidence that you checked.
There is no patch for our NAS yet. Are we out of compliance?
Not if you assessed the risk, removed internet exposure and documented it. Track it until the vendor fix ships, then close it.
Does PHP2Shell affect our website?
If your site runs on PHP, yes. Most public websites sit outside the CUI boundary, but patch them too.
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.