PHP2Shell vulnerable?

[Work_Throw-33]

I've been tasked with finding out what, if any, of our networkable office devices are at risk from the PHP2Shell vulnerability and, if they are, what steps to follow to mitigate the situation. Trying to go through customer support has led me here.

We have just the one HP printer, a DeskJet 4155e All-in-One.

[VikramTheGreat]

Hi @Work_Throw-33,

Welcome to the HP Support Community.

Thank you for checking the security status of your network-connected devices.

HP has published an advisory for the PHP vulnerabilities known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. HP confirms that HP Consumer/Pro Ink, Laser, and All-in-One printing devices are not affected. The HP DeskJet 4155e All-in-One Printer falls within the HP consumer ink All-in-One category.

Therefore, based on HP’s current advisory:

• Your HP DeskJet 4155e is not affected by PHP2Shell.
• No PHP2Shell-specific mitigation is required for this printer.
• You do not need to disconnect or replace the printer because of these vulnerabilities.

You can review the official advisory here: PHP Vulnerabilities also known as "PHP2Shell" | HP® Support

As a general security measure, continue installing firmware updates offered for the printer through HP’s official software and driver page. HP states that printer firmware updates can include bug fixes, compatibility improvements, and security software updates when applicable.

You can also monitor the official HP Security Bulletins | HP® Support page for future HP security advisories.

Take care and have a good day!