Update: Critical Vulnerabilities in PHP Require Immediate Patching

10/23/2026 8:00 PM EDT

Update October 23, 2026: CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.

Purpose

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication, they pose a risk to organizations if left unpatched.

Actions to Take

CISA urges organizations to take the following actions:

• Identify and inventory systems running any version of PHP across your organization.
  • PHP is often a component of other software and prevalence may not be directly observable.
• Apply the patch immediately, prioritizing internet-facing systems.
• Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
• A web application firewall may provide some protection until systems are updated or patched.
• Review the official PHP security advisory for guidance on patching.
• Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

Resources

CISA urges network defenders to review the following advisories and resources and apply necessary updates: 

PHP’s Guidance

• PHP’s Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now
• PHP’s Blog: Today’s PHP Security Release, and How We’re Strengthening PHP Security

Partner Guidance

• United States National Security Agency’s (NSA) Advisory: Critical Patches Recommended for PHP Vulnerabilities
• United Kingdom National Cyber Security Centre’s (NCSC-UK) Alert: Critical security issue affecting PHP
• Australian Signals Directorate’s Australian Cyber Security Centre’s (ASD’s ACSC) Alert: Critical vulnerabilities in PHP
• National Cyber Security Centre’s (NCSC-NL) GitHub repository: php2shell
• New Zealand National Cyber Security Centre’s (NCSC-NZ) NCSC encourages immediate patching against PHP vulnerability
• Canadian Centre for Cyber Security’s (Cyber Centre) Alert: Critical vulnerabilities impacting PHP – CVE-2026-109618 and CVE-2026-109619

Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources (Note: CISA may update this resource as more information becomes available):

• CISA’s SIGMA Rules GitHub Repository

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.