On October 21, 2026, a critical PHP vulnerability made the rounds, and a thread on the Home Assistant community forum asked the obvious question: is HA affected, and do we need to act? Here is what the pages we read show, and what we would check on an installed system.
What happened
According to a GitHub issue on the phpMyAdmin add-on, PHP released emergency security updates on October 21 for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". Exploitation in the wild is now confirmed: the US cybersecurity agency CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. The fixed PHP versions listed are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
One forum reply relays a notice from Nextcloud, which cites a CERT-EU statement and says the issue affects PHP servers broadly, including Nextcloud and WordPress, and can let an attacker compromise the server. That is a relayed message, not something we verified at the source.
Where Home Assistant comes in
Several forum replies say Home Assistant core does not use PHP and is therefore not directly affected. We did not find an official statement from the Home Assistant team in the thread, so that is community opinion, not a confirmed answer.
The real exposure is add-ons (now called apps) built on PHP. The one named in the thread is the phpMyAdmin add-on. Its issue lists what it currently ships: phpMyAdmin 5.2.3, PHP 8.4.24 and nginx 1.30.4 on Alpine. That PHP version is below the fixed 8.4.27. The issue asks for a rebuild with patched PHP, or an ETA if the Alpine package is not ready. That issue is now closed: version 0.14.1 of the app, released October 23, ships the patched PHP.
What to check
- Is phpMyAdmin installed? If you never added it, this does not touch you. If you did, update it to version 0.14.1 or newer, or uninstall it if you no longer need it.
- Is anything PHP-based reachable from outside? That includes Nextcloud, WordPress or any other add-on or container you run. Those are the risky ones, and the Nextcloud notice went as far as advising a shutdown until patched.
- Are any ports forwarded on your router? Forum replies note that VPN access, Nabu Casa cloud and Cloudflare tunnels do not open inbound ports. Even so, an add-on that is running is still running, so stopping unused ones is cheap insurance.
- Watch the add-on’s update list. Once a patched build appears, update first, then decide whether you still need the add-on at all.
What owners are asking
Is Home Assistant itself vulnerable? Replies say core is Python and not affected. There is no official confirmation in the thread, so we would check the Home Assistant team’s own channels for a statement.
Is the add-on dangerous if I only use it at home? One reply argues the risk is small because you must be logged in to the Home Assistant frontend to reach the phpMyAdmin container. That is an opinion, not a tested claim. The same reply says there is rarely a good reason to leave it running, and we agree. We know of no confirmed exploit path against the add-on specifically.
Does remote access change anything? Replies suggest a direct, internet-facing PHP application is the dangerous case, while setups behind a VPN or an outbound-only connection are less exposed. Fair, but not a reason to leave an unpatched service running.
When is the fix coming? It is out. Version 0.14.1 of the phpMyAdmin app, released October 23, ships the patched PHP. Update to it.
Our take
For installed systems this is a housekeeping job, not a panic. Home Assistant core does not appear to be the problem. Audit what else runs beside it, close anything you do not use, and keep anything PHP-based off the internet until it is patched. Database tools are the kind of add-on people install for one afternoon and forget, so this is a good prompt to clear them out.