ASUSTOR removes older PHP versions from App Central after PHP2Shell
What it means for Australian buyersASUSTOR has removed PHP 7, 7.3, 7.4 and 8.1 from App Central and released patched PHP 8.3 and 8.4 packages. If you run PHP-based apps on ADM, move them to the patched versions.
ASUSTOR published advisory AS-2026-023 on 23 October 2026. It says the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect ASUSTOR products with PHP installed on ADM.
Because the PHP project only provides security patches for PHP 8.2 and later, ASUSTOR is removing PHP 7, PHP 7.3, PHP 7.4 and PHP 8.1 from App Central. It has released PHP 8.3.36 on App Central for ADM 4.3 and ADM 5.0, and PHP 8.4.27 for ADM 5.0.
What to do
- In App Central, update to the patched PHP 8.3 or 8.4 release for your ADM version.
- Check that any web apps you run still work on the newer PHP version before removing the old one.
Sources
- AS-2026-023: PHP (PHP2Shell), ASUSTOR (accessed 24 Oct 2026)
Facts last checked 24 October 2026. Published 24 October 2026.