Check the exact model before deciding whether your Xerox printer needs a PHP2Shell fix. Xerox lists several AltaLink and VersaLink office printers as affected, with patches expected on November 6. Many compact C-series and B-series models are listed as not impacted. Those findings cover the current firmware releases Xerox evaluated, rather than every older version.
Which printers Xerox lists
Xerox first published its bulletin on October 23 and updated it on October 28. The same bulletin covers Lexmark, and it lists Lexmark printer firmware as not impacted.
| Printer | Status | Fix |
|---|---|---|
| AltaLink and EC81xx | Affected | Expected November 6 |
| VersaLink C415, B415, C625, B625, C620, B620 | Affected | Expected November 6 |
| WorkCentre 3655, EC7836, EC7856 | Affected | In development, no date |
| VersaLink C400, C405, C500, C505, C600, C605 | Not impacted | Not impacted in the evaluated release |
| VersaLink B400, B405, B600, B605, B610, B615 | Not impacted | Not impacted in the evaluated release |
| C230, C235, C240, C245, C255a, C300, C303a, C305ae, C320, C325, C410 | Not impacted | Not impacted in the evaluated release |
| B225, B230, B235, B305, B310, B315, B410 | Not impacted | Not impacted in the evaluated release |
Xerox lists the VersaLink C405 as not impacted, while the C415 needs a fix. November 6 is the target release date, not confirmation that a patch is available.
The not-impacted rows include home and small-office lasers such as the print-only Xerox C240. This bulletin alone gives owners of those evaluated models no reason to replace them.
Offices that run production printers through a Fiery print server, the controller that prepares print jobs, have a separate schedule. Fiery targets November 9 to November 23 for its patches, depending on the software version.
What PHP2Shell is
PHP is a programming language used to build web pages, and some products run it inside their own software. CISA says the two flaws let an attacker run code on any PHP installation that serves web requests, without logging in. Its alert went out on October 21, and on October 26 the agency added both flaws to its catalog of vulnerabilities known to be exploited.
That catalog entry is about PHP in general. Xerox doesn't say whether anyone has attacked a printer this way, and its bulletin gives no workaround for the affected models yet.
Until the fix posts
CISA's advice to organizations is to patch internet-facing systems first. Where a patch isn't possible yet, it says to take PHP-based systems offline.
Ask whoever manages an affected printer to follow CISA’s guidance until a fix is available. Keeping it reachable only from the office network does not establish that it is safe. Remove any internet exposure, such as router port forwarding to its management page, and arrange for the unpatched system to be taken offline.
Xerox says it will update the bulletin when fixes become available. Match the release to your exact model and installed firmware before applying it.
