CISA: Critical Vulnerabilities in PHP Require Immediate Patching

What it is

CISA published an alert on 21 October 2026, updated 23 October 2026, urging immediate patching of CVE-2026-109618 and CVE-2026-109619, known as "php2shell". Both allow unauthenticated remote code execution in PHP. CISA had not observed successful exploitation in the wild as of publication.

Preconditions / Affected

All PHP installations serving web requests are affected: Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The alert notes that PHP itself considers mod_php the highest risk. PHP 8.1 and earlier are unsupported and get no fix. CISA warns that PHP is often embedded in other software, so exposure may not be visible from a simple inventory.

What to do

1. Inventory every system running any version of PHP, including PHP bundled inside other products.
2. Update to a fixed release: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Patch internet-facing systems first.
3. If a system cannot be updated immediately, or runs PHP 8.1 or earlier, take it offline until it is patched or upgraded.
4. Review PHP's own security advisory for patching guidance.
5. Monitor for PHP worker processes launching shells or downloading tools. The 23 October update adds a CISA Sigma rule for this, which CISA says it may revise as more information arrives. The page text does not reproduce the rule.

Caveats

A web application firewall "may provide some protection" until patching, and CISA gives no detail on what it blocks. The page does not describe the vulnerability mechanism or exploit conditions beyond the affected server modes. Partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Canadian Cyber Centre) are linked but not summarized.