An analysis finds that a large number of devices running PHP on corporate internal networks are exposed to the security vulnerability known as PHP2Shell. There are calls for security checks not only of public-facing web servers but also internal network equipment such as network-attached storage (NAS), routers and firewalls.

Genians said on Thursday that its analysis of device identification data accumulated on its cloud network access control (NAC) platform showed 96% of internal-network devices running PHP were exposed to the PHP2Shell vulnerability.

PHP2Shell is a vulnerability that can allow attackers to run malicious code on a system remotely without separate authentication. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 26 added two related vulnerabilities (CVE-2026-109618, CVE-2026-109619) to its Known Exploited Vulnerabilities (KEV) catalog.

Genians said 78% of vulnerable devices were using older versions 8.1 or earlier for which official PHP support has ended. Devices running versions 5.x or earlier, for which support ended in 2018, accounted for 48%. By device type, general servers accounted for 24%, CCTV and video storage devices and security solutions 20%, internet of things (IoT) devices such as RFID readers 17%, and unidentified assets whose type was not confirmed 27%.

It said 89% of identified devices were located in private IP ranges that are difficult to access from the external internet. That makes it hard to identify internal-network security risks through vulnerability diagnostics focused on external web servers, it said.

Genians warned that if attackers take control of vulnerable internal devices, they could use them to infiltrate other systems or spread ransomware. It said companies and institutions should identify assets connected to internal networks and check whether security patches have been applied.

Kim Gye-yeon (김계연), head of Genians' U.S. unit and its chief technology officer, said, "For managed devices located on internal networks, you can determine whether they run PHP only by precisely identifying web console response data and built-in components." He added, "For older devices without an official patch, or devices that are in the stage before patch distribution, proactive controls to immediately block and isolate network access until replacement are essential."

Genians is also upgrading the asset identification technology of its Genian NAC with agentic AI and developing a next-generation asset and threat intelligence platform. It also plans to use its core cyber asset attack surface management (CAASM) technology to integrate management of enterprise IT assets, while having AI agents collect and analyse vendor security advisories and patch information and vulnerability trends and link them with customer assets.