Press play to start listening
Research found 426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, raising concerns about backend security.
NowSecure has identified 426 Android and iOS apps connecting to servers that report versions of PHP (Hypertext Preprocessor), a programming language used to build websites and backend services, affected by the recently patched PHP2Shell vulnerabilities.
In research shared with Hackread.com, the cybersecurity firm urged developers to check the servers supporting their apps, including those operated by outside providers. The reported versions alone do not confirm whether a server remains unpatched or can be exploited.
PHP2Shell Flaws Raise Backend Security Concerns
The PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, each rated CVSS v4.0 9.2. Hackread.com reported on the emergency PHP2Shell fixes, which address flaws that can allow unauthenticated attackers to execute code on affected servers.
For context, both PHP2Shell vulnerabilities were first identified by independent researcher @lcfr_hax. The flaws affect PHP running on the servers that mobile apps contact, not software installed on users’ phones. Servers using Apache’s mod_php component, which runs PHP within the web server, face particular risk because an attack can succeed before the website’s own code starts running.
Wiz Research also demonstrated how AI models could help develop working exploit chains for the flaws. NowSecure’s research examined how many mobile apps were connecting to servers that could still be vulnerable.
8.5% of Assessed Apps Connected to Potentially Vulnerable Servers
NowSecure’s findings analysed 15,429 mobile apps and found that 454 connected to servers that disclosed their PHP versions. Of those apps, 426, or 93.8%, contacted servers running potentially affected versions. Of those 426 apps, 170 connected to servers running end-of-life PHP branches that no longer receive official upstream security updates.
The company also reported in its blog that 8.5% of assessed apps connected to at least one potentially vulnerable PHP server. This does not mean those servers were all exploitable or remained unpatched.
The findings also show how a single backend can affect many apps. One advertising vendor’s server was contacted by 151 apps, while 88% of the identified PHP servers served just one app, often through a developer’s own backend. Fixing the issue can therefore depend on whether the server belongs to the app developer or an outside provider.
Developers Need to Identify Who Runs Their Servers
Some apps connect to PHP servers through third-party advertising or analytics tools. In these cases, developers may not know who operates every server their apps contact. They will need to work with those providers to confirm whether the affected PHP versions have been updated.
NowSecure plans to add a feature to its platform that identifies apps connecting to servers that report potentially affected PHP versions. Developers will still need to check with the server owner to confirm whether the fixes have been applied.
Teams are advised to “treat the finding as an infrastructure and application security incident,” and update affected servers to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Those running PHP 8.1 or older should move to a supported branch or check if their vendor has released a fixed package. It is also important to review server logs for signs of exploitation and possible exposure of credentials or access tokens.
