CISA Issues Urgent Advisory on Critical PHP Vulnerabilities Tracked as 'php2shell'

The Cybersecurity and Infrastructure Security Agency (CISA) has released an urgent alert regarding two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Security researchers and maintainers have grouped these flaws under the nickname 'php2shell.'

According to the advisory, the vulnerabilities allow unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. PHP is a ubiquitous scripting language used in web infrastructure globally, making the potential impact widespread.

CISA reports that as of the time of publication, exploitation of these vulnerabilities has not been observed in the wild. However, the agency emphasizes that the flaws pose a significant risk if left unpatched, particularly on internet-facing systems.

The advisory recommends that organizations immediately identify and inventory all systems running PHP, noting that PHP is often embedded within other software, making prevalence difficult to observe directly. Patching should be prioritized for internet-facing systems. Organizations unable to update immediately, or those continuing to use PHP 8.1 or earlier unsupported versions, are advised to take PHP-based systems offline until patches can be applied.

A web application firewall (WAF) may provide interim protection, though CISA notes this is not a guaranteed mitigation. The agency also recommends monitoring for suspicious activity, including PHP worker processes launching shells or downloading tools.

Affected versions and required updates:
- PHP 8.5.12 or later
- PHP 8.4.27 or later
- PHP 8.3.36 or later
- PHP 8.2.35 or later

CISA directs defenders to the official PHP security advisory for detailed guidance on patching and mitigation. The advisory was published on 2026-10-21.