PHP2Shell and CCTV Security: The Hidden Vulnerabilities Behind Your Cameras
Your cameras are recording. But do you know what’s running behind them?
A CCTV inventory usually tells you how many cameras you have and where they’re installed. It may tell you very little about the software used to manage those cameras, view footage remotely or export evidence. That gap became visible when Milestone confirmed that Evidence Manager, an extension to its XProtect video management system, used a vulnerable version of PHP. Milestone assessed the core XProtect platform as unaffected. Two components in the same surveillance setup had different exposure to the same vulnerability.
For facilities, physical security and IT teams, that raises a practical question. When a critical vulnerability is announced, can you identify every affected component and fix it without losing access to live video, recordings or evidence?
How PHP2Shell surfaced and what happened next
PHP2Shell refers to two critical flaws in the core PHP runtime, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, a vulnerable service can expose sensitive process memory or let an attacker run code without signing in. Security researchers reported the flaws to PHP maintainers, who coordinated fixes with software distributors and vendors.
| Date | What happened |
| 20–21 October 2026 | The vulnerability IDs began circulating online ahead of the planned release. The PHP project moved the release forward by a day and published security fixes on 21 October. |
| 22 October 2026 | Milestone confirmed that its Evidence Manager extension used vulnerable PHP and advised customers to update it. The vendor assessed core XProtect as unaffected. Dahua separately reported that its network cameras and recorders were unaffected. |
| 26 October 2026 | Bleeping Computer reported that Perplexity’s security team observed successful remote code execution against a deliberately exposed, vulnerable Apache/PHP honeypot. The observation came from a monitored decoy system. |
| 3 November 2026 | Singapore’s Cyber Security Agency reported active exploitation against internet-exposed management interfaces on affected Palo Alto Networks firewalls. |
What the PHP2Shell incidents tell us about CCTV security
The firewall attacks show what can happen when a vulnerable management interface is reachable from the internet. For CCTV teams, Milestone’s advisory establishes a different fact: a surveillance extension needed patching even though the core video management platform was unaffected. The advisory identifies vulnerable software and gives remediation instructions. It does not report a compromise of CCTV systems.
Where hidden vulnerabilities can sit in a video surveillance system
| Component | What to check |
| IP cameras and network video recorders (NVRs) | Model and firmware version, vendor support status, and whether web management pages are reachable from outside the CCTV network. |
| Video management system (VMS) | Installed version, plug-ins, evidence management tools and any separate servers or software runtimes they use. |
| Remote viewing and vendor access | Public portals, firewall port forwarding, shared administrator accounts and access retained by former service providers. |
| Surveillance network | Which systems can reach cameras and recorders, and whether CCTV traffic is segmented from the corporate network. |
Start with one site and trace how an operator views a live feed, retrieves a recording and exports a clip. Each step may touch a different system. Record the owner, version and access path for each component you find.
How to check for PHP2Shell exposure and secure your CCTV system
1. Verify affected components and prioritize reachable systems
Compare your inventory against vendor advisories for both CVEs. Check the VMS extensions and supporting servers as well as the devices. Prioritize confirmed vulnerable components with internet-facing interfaces or broad internal access. Record components with unknown versions or unclear vendor guidance and assign someone to verify them.
2. Reduce exposure while you prepare the fix
Remove unnecessary public access to management interfaces. Restrict administration to approved networks and authorized users and use multifactor authentication on supported remote-access services. Where feasible, segment the CCTV network and permit only the connections needed for monitoring, recording and maintenance. Treat these controls as interim protection for vulnerable components awaiting an update.
3. Apply the vendor-approved update and verify the running version
For packaged surveillance products, follow the vendor’s remediation instructions. For Milestone Evidence Manager, the advisory directs users to upgrade PHP to 8.2.35. For independently managed PHP services, use a security-fixed release or vendor package appropriate to the deployment and verify that the running service has picked up the fix. If a component is out of support, restrict access and plan its replacement or migration.
4. Test surveillance workflows and investigate suspicious activity
Coordinate changes with the physical security team and agree on a maintenance window and rollback plan. After the update, verify live feeds, recording, playback, evidence export and authorized remote viewing. If exploitation is suspected, preserve available logs and involve the incident response team so it can investigate and coordinate containment alongside remediation.
Some CCTV cybersecurity FAQs
- How do I know if my CCTV system is affected by PHP2Shell?
Check the exact camera, recorder, VMS and extension versions against the relevant vendor advisories. Include any server or portal that supports remote viewing, administration or evidence management.
- Does updating camera firmware fix PHP2Shell?
The fix depends on where the vulnerable PHP runtime is installed. If exposure is in a VMS extension or web portal, apply the fix to that component according to its vendor’s instructions.
- How Visiontech can help secure your CCTV environment
Visiontech’s ELV and cybersecurity teams can assess the full surveillance setup, from cameras and recorders to VMS extensions, management interfaces and remote vendor access. We can help identify which findings need immediate attention, prioritize patching and network segmentation, and coordinate remediation around your monitoring and recording requirements.
Book a CCTV Cybersecurity Assessment with Visiontech. Start with one site. We’ll help you map what sits behind your cameras, identify which systems need attention first, and define what to test after remediation.