Government Advisory

CISA Urges Immediate Patching of Critical PHP Flaws Dubbed 'php2shell'

CISA · 21 Oct 2026

Key Takeaway List every website and application that uses PHP (including those from third-party vendors), update internet-facing ones to a fixed version straight away, and take unsupported ones offline until they are patched.

CISA has issued a strong call for organisations to patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together known as "php2shell". The flaws allow an unauthenticated attacker to run code remotely, and they affect all PHP installations that serve web requests. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA has not observed exploitation so far, but unpatched systems remain at risk.

CISA recommends first finding every system that runs PHP. PHP is often built into other software, so it may not be obvious where it is in use. Internet-facing systems should be patched first. Organisations that cannot update straight away, or that still run PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be updated. A web application firewall may offer some protection in the meantime.

Defenders should also watch for suspicious activity, such as PHP worker processes launching shells or downloading tools, and review the official PHP security advisory for patching guidance.

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.