CISA urges immediate patching for critical PHP flaws

The Cybersecurity and Infrastructure Security Agency said on Oct. 26 that organizations should immediately patch two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. CISA said the flaws, known as “php2shell,” can allow unauthenticated remote code execution and affect PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. It added the vulnerabilities to its Known Exploited Vulnerabilities Catalog that day.

PHP’s development team said security releases were available for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, each fixing the two vulnerabilities. The PHP development team said users should update immediately.

Britain’s National Cyber Security Centre also urged UK organizations to take immediate action on the issue and said the update may stop attackers from executing commands on web servers running PHP. The agency said organizations that cannot update right away should look for signs of compromise and monitor third-party products that bundle PHP for further security updates.

Sources

• Critical Vulnerabilities in PHP Require Immediate Patching

• News Archive - 2026

• Critical security issue affecting PHP