CISA urges immediate patching of critical php2shell PHP flaws

CISA is urging organizations to patch the critical php2shell flaws in PHP right away. The agency said the two bugs, CVE-2026-109618 and CVE-2026-109619, are known together by that name.

The flaws let attackers run code on a server without logging in. CISA said they affect all PHP installations serving web requests, so the reach is wide.

Key facts

• CISA urged immediate patching of CVE-2026-109618 and CVE-2026-109619, the two php2shell flaws.
• The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to CISA.
• CISA says systems running PHP 8.1 or older unsupported versions should go offline until patched.
• CISA said it had not seen successful exploitation in the wild when it published the alert.
• VirusTotal estimates over 5.1 million PHP hosts are exposed online, BleepingComputer reported.

What the php2shell flaws do

Both bugs allow unauthenticated remote code execution. CISA said they hit setups including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

BleepingComputer reported that both flaws come from PHP leaving its memory corrupted when a request ends abnormally. Full technical details of the exploit have not been made public.

The PHP security team sees one setup as most at risk. "We consider the risk highest for mod_php," the team said, according to BleepingComputer. The team said a demonstrated exploit for mod_php triggers before any application code runs, BleepingComputer reported.

Researchers from Calif, OpenAI and Wiz found the two flaws, according to BleepingComputer.

Background

PHP is an open-source language that runs on web servers. BleepingComputer says it powers 75% to 80% of all websites, including sites built on WordPress, Joomla and Drupal.

That reach makes the bugs a large target. VirusTotal estimates more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open, BleepingComputer reported. How many of those servers remain unpatched is not known.

Other governments have also responded. CISA's alert links to guidance from agencies in the UK, Australia, New Zealand, Canada and the Netherlands, as well as the NSA.

CISA updated the alert on October 23, 2026 to add a SIGMA detection rule and partner resources.

Is it being exploited?

Reports differ on activity so far. CISA said it had not observed successful exploitation in the wild as of publication. Whether any compromises have been confirmed is not known.

However, Cloudflare CTO Dane Knecht said the company was already seeing early attacks on the two flaws before patches came out, BleepingComputer reported.

What it means for you

Anyone who runs a website or web app on PHP should assume they are affected. CISA warns that PHP is often built into other software, so it may not be visible. For that reason, the agency says organizations should list every system that runs PHP.

People who only visit websites do not need to install anything. The fix must come from the companies and site owners that run PHP servers.

Practical steps

CISA and the PHP project point to several steps:

1. Find PHP. CISA says organizations should inventory every system running PHP, since it can hide inside other products.
2. Update now. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, CISA says, starting with systems that face the internet.
3. Take old systems offline. CISA says machines that cannot be updated, or that run PHP 8.1 or older, should go offline until patched.
4. Use a firewall as a stopgap. CISA says a web application firewall may offer some protection until patching is done.
5. Watch for warning signs. CISA advises looking for PHP worker processes launching shells or downloading tools, and reviewing its SIGMA detection rule.
6. Building from source. The PHP team released minimal backports for PHP 7.4, 8.0 and 8.1 for people who compile PHP themselves, BleepingComputer reported.

Workarounds are not a full answer. PHP core developer Gina Peter Banyard cautioned that no stopgap fully stops attacks, BleepingComputer reported. In Banyard's view, only the official patches offer a lasting fix.

What is still unknown

Several key questions remain open. It is not known whether any attacks have led to confirmed break-ins. It is also not known how many of the exposed servers are still unpatched, or exactly how the exploit works in full detail.

Those gaps are why CISA's advice leans toward caution. The agency tells organizations to prioritize internet-facing systems and to keep watching for odd behavior after updating.

What happens next

CISA said it may update its SIGMA detection resource as more information becomes available. Organizations should check the alert for changes.

FAQ

Which PHP versions fix php2shell? BleepingComputer says the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project has stopped updating PHP 8.1 and earlier, the site said.

Is php2shell being exploited? CISA had not seen successful exploitation at publication. Cloudflare said it saw early attacks before the patches shipped, BleepingComputer reported.

What should an organization do if it cannot patch right away? CISA says such organizations should take PHP-based systems offline until patched.

Which server setups are affected? CISA lists Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, among all PHP installs serving web requests.

How many servers could be exposed? VirusTotal estimates more than 5.1 million PHP hosts are online, BleepingComputer reported. It is not known how many remain unpatched.

Who found the flaws? BleepingComputer says researchers from Calif, OpenAI and Wiz discovered them.

Do website visitors need to do anything? No. The update must be applied on the servers that run PHP, which CISA says should be patched immediately.