CISA urges immediate patching of "php2shell" PHP flaws
Unauthenticated remote code execution hits every PHP installation serving web requests; internet-facing systems get patched first.
TL;DR
CISA issued an alert on two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, tracked as "php2shell." They affect every PHP installation serving web requests, and CISA has not observed exploitation as of publication. Patches are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; organizations that can't update immediately, or that run PHP 8.1 or earlier, should take those PHP systems offline until patched.
CISA's alert names two critical flaws, CVE-2026-109618 and CVE-2026-109619, and ties them to unauthenticated remote code execution in PHP. The advisory calls them "php2shell" and says every PHP installation serving web requests is in scope. Fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA has not observed exploitation as of publication, but the case for speed stands: the code path is remote and unauthenticated.
The recommended sequence is concrete. Inventory PHP across the environment first; PHP often ships as a component of other software, so CISA warns it may not be directly observable. Patch internet-facing systems first. Organizations that can't update immediately, or that keep running unsupported PHP 8.1 or earlier, should take those PHP-based systems offline until they can be patched or upgraded. A web application firewall may offer partial protection in the meantime. CISA also directs defenders to review the PHP security advisory and watch for PHP worker processes spawning shells or downloading tools.
Published ·Deep Fathom