CISA Urges Immediate Patching of Critical 'php2shell' Vulnerabilities in PHP

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to immediately patch two critical vulnerabilities in PHP, warning that the flaws expose any website running the language to remote attack.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively known as 'php2shell.' They allow unauthenticated remote code execution - an attacker needs no account or password - and affect all PHP installations serving web requests, according to the agency's October 21 alert. The issue carries a severity score of 9.2 out of 10.

Fixed versions are available now: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project says there are no complete workarounds, so administrators should treat the update as an emergency change rather than waiting for a scheduled maintenance window. Sites running PHP branches below 8.2 have no fix available; those branches are end-of-life, and the guidance is to upgrade to a supported branch or take the site offline.

CISA said it had not observed exploitation of the vulnerabilities as of the time of publication, but stressed that they pose a serious risk if left unpatched. PHP underpins a large share of the world's websites, from small business pages to major publishing platforms, which makes the potential exposure unusually wide.

Operators can check their version by running php -v on the server or looking in their hosting control panel, and should confirm the version again after updating.

Source: CISA