Legacy PHP Retirement Announcement

2026-10-22

---

On October 21, 2026, the PHP Group released patches for two critical vulnerabilities - CVE-2026-109618 and CVE-2026-109619 which are commonly known as the PHP2Shell vulnerabilities. Both vulnerabilities allow for unauthenticated remote code execution (RCE), potentially granting an attacker the same execution privileges as the web service itself.

ASUSTOR is committed to data security as well as the security of our products. As the PHP Group only provides security patches for versions 8.2 and later, PHP 7, PHP 7.3, PHP 7.4, and PHP 8.1 are being removed from App Central effective immediately. ASUSTOR strongly recommends backing up important data immediately and removing all legacy PHP versions from an ASUSTOR NAS, and use only PHP 8.3 or 8.4 from now on.