426 Mobile Apps Exposed by PHP2Shell Vulnerabilities

A scan by NowSecure on October 23, 2026 identified 426 Android and iOS applications that reach out to web servers advertising PHP versions that could still be running the recently patched PHP2Shell flaws. The scan covered 15,429 apps, of which 454 reported PHP versions on the servers they contacted. 426 of those 454 apps—93.8%—were found to be reaching servers that could still be running vulnerable PHP branches.

PHP2Shell: What the CVEs Allow

The PHP project released emergency fixes for CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. Both flaws carry a CVSS v4.0 score of 9.2 and enable unauthenticated attackers to execute arbitrary code on affected servers. The vulnerabilities surface in PHP running on the servers that mobile apps contact, not in the apps themselves. Servers that use Apache’s mod_php component are especially at risk because the flaw can be exploited before the web application’s own code runs.

Scope of the Scan

NowSecure examined 15,429 mobile apps across Android and iOS. Of those, 454 apps reported PHP versions on the servers they contacted. 426 of the 454 apps—93.8%—were found to be reaching servers that could still be running vulnerable PHP branches. 170 of the 426 apps connected to servers that ran end-of-life PHP branches that no longer receive official security updates. The scan also revealed that 8.5% of the assessed apps had at least one potentially vulnerable PHP server in their network path.

How a Single Backend Can Amplify Risk

The data shows that a single backend can serve many apps. One advertising vendor’s server was contacted by 151 apps, while 88% of the identified PHP servers served only one app, often through a developer’s own backend. This concentration means that a compromise of a popular advertising or analytics endpoint could expose a large number of apps simultaneously.

What Developers Should Verify

Apps that rely on third-party advertising or analytics services may not know who operates every server they contact. Developers must identify the owner of each backend and confirm that the PHP version has been updated to a supported release—PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Those still on PHP 8.1 or older should migrate to a supported branch or check whether their vendor has released a patched package.

Signs of Exploitation

Beyond patching, teams should review server logs for indicators of exploitation, such as unexpected code execution or the appearance of new user accounts. Credential or access-token leaks could also surface if an attacker gains persistence on the backend.

NowSecure’s Next Steps

The firm plans to add a feature to its platform that flags apps connecting to servers reporting potentially affected PHP versions. However, the tool will still require developers to verify with the server owner that the fixes have been applied.

Practical Takeaway for App Builders

  1. Map every external server your app contacts, including advertising and analytics endpoints.
  2. Check the PHP version on each server and confirm it matches a patched release.
  3. If a server is on an end-of-life branch, negotiate a migration or seek an alternative provider.
  4. Monitor logs for signs of code execution or credential leakage.

Open Question

The scan does not confirm that all identified servers are still exploitable or unpatched. The next step for affected developers is to perform a targeted audit of each backend to determine the actual risk level.

For more on how backend vulnerabilities can ripple through app ecosystems, see the Web3 Wallet Drainer Threat Intelligence & Defense Playbook.

  • Web3 Wallet Drainer Threat Intelligence & Defense Playbook
  • Gcore WAAP Free for Public Agencies Until Year End
  • Serengeti III arrest: 1,462 arrests and $105M recovered across 21 African nations

Explore more on this topic

  • More php coverage