Pi-hole LLC

Pi-hole v6 (FTL and Docker 2026.10.0)

Response status

No PHP; unaffected by PHP2Shell

Response information checked

2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Network DNS ad-blocking software from Pi-hole LLC.

The October 24 official announcement says v6 Core/FTL and Docker 2026.10.0 contain no PHP. v6 uses an embedded web server.

Scope: This does not assert the official website or entire host is PHP-free.

What users should do

No PHP remediation for v6 itself; separately check old PHP packages or other applications remaining on the host.

Official service URL

• https://pi-hole.net/

Source URLs

1. PHP2Shell response and scopehttps://discourse.pi-hole.net/t/pi-hole-v6-is-not-affected-by-the-php-vulnerabilities-php2shell/88058Response evidence

Pi-hole v5 and PHP remaining after migration

Response status

Migrate to v6 and check remaining packages

Response information checked

2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Unsupported v5 uses PHP and lighttpd. The announcement warns these old packages can remain on the host after a v6 upgrade.

Scope: Upgrading Pi-hole alone does not confirm remediation of host PHP.

What users should do

Migrate v5 to v6. Update remaining PHP if required; remove it only after confirming other applications do not need it.

Source URLs

1. PHP2Shell response and scopehttps://discourse.pi-hole.net/t/pi-hole-v6-is-not-affected-by-the-php-vulnerabilities-php2shell/88058Response evidence