Remko Weijnen and I did some research on the impact of #php2shell on NetScaler , and published the result of our analysis on the fixed build: https://remkoweijnen.nl/blog/2026/10/27/netscaler-php2shell-citrix-patch/ 🚨🚨🚨

I was wondering the same a while ago on which PHP version is NS running, I came up with #php -version but obviously it wasn't as advanced as your own investigation 😅

Biggest issue is there is no version bump, so you can't do anything but investigate further. 👌🏻🤌

Yeah, not the first time they backport patches, it's appreciated but also an annoying habit explaining it to security when all they know is to look at version numbers. >.<

Inline fix has the least amount of change, which incurs the least risk for the fastest turnaround possible. We will upgrade to the later php build when we have spare testing cycles.

Solid teardown. Citrix did the exact upstream backport instead of upgrading PHP, the safest short-term move when you are stuck on ancient FreeBSD and do not want to trigger another full FIPS/NDcPP revalidation cycle. Dropping PHP entirely in 15.1 and replacing it with custom code would be cleaner, but the certification cost and delay would be real…

@Eric Beiers spare testing cycles? 😅 I think NetScaler was very fortunate that the team at PHP actually back ported the fix to 8.1!! So if it’s really about having spare test cycles, shouldn't Cloud Software Group be hiring?

Was thinking the same thing yesterday, 8.1 didn't go EOL a month ago, those test cycles must be planned out half a decade ahead if so.