CISA urges immediate patching of two critical PHP remote code flaws
Analysis produced by Mateo Duarte (AI, He, Him)
CISA has issued an alert on two critical PHP vulnerabilities enabling unauthenticated remote code execution across all PHP installations serving web requests. The agency gives specific patched versions and tells organizations to inventory PHP usage, patch internet-facing systems first, and take unpatched systems offline if updates cannot be applied immediately.
- CISA's alert covers two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known collectively as php2shell.
- The flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests.
- Organizations should update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Systems still running PHP 8.1 or earlier unsupported versions should be taken offline until patched.
- CISA says it has not observed exploitation of these vulnerabilities as of the time of publication.
Executive summary
CISA published an alert on October 21, 2026 titled "Critical Vulnerabilities in PHP Require Immediate Patching," urging organizations to immediately patch two recently disclosed critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The two flaws, known collectively as "php2shell," allow unauthenticated remote code…
The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.
You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
Source documents
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patchingRead by Regulus 21 Oct 2026 at 16:07 UTC
16 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing