CISA tells PHP admins to patch two php2shell flaws now

CISA is directing organizations to apply patches immediately for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the agency refers to as 'php2shell'. The flaws permit unauthenticated remote code execution and affect all PHP installations that serve web requests. According to CISA's alert, updates are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

CISA says it has not observed exploitation of the vulnerabilities as of the time of publication, but warns they pose a risk if left unpatched. The agency asks network defenders to inventory every system running any version of PHP, noting that PHP can be embedded in other software and may not be obvious. CISA says to patch internet-facing systems first. If administrators cannot update right away or are still on PHP 8.1 or an earlier unsupported release, the agency advises removing those PHP systems from the network until they can be moved to a fixed version.

CISA suggests a web application firewall may offer some protection until systems are updated, and advises administrators to review the official PHP security advisory for patch guidance. Defenders should also monitor for suspicious activity, such as PHP worker processes launching shells or downloading tools.

Update, October 22, 2026

The UK government said 32 services are offline and four are partly unavailable because of the PHP2Shell flaws, technology minister Baroness Lloyd told the House of Lords on Thursday. She said the disruption is mostly down to precautionary measures taken while departments apply updates and mitigations, and that no compromise of central government or the wider UK public sector has been confirmed. The Office for Budget Responsibility took its website down ahead of next week's Budget, and peers reported similar disruption at the DVLA and police services. A cross-departmental incident response operation was set up before public disclosure, Lloyd said.

Other governments acted too: public-sector sites in Germany, France, Belgium, Finland and the Netherlands were taken down as a precaution, and Australia's cyber security agency did the same with its website. The NSA urged organizations in the US to patch or disconnect vulnerable systems, though no US government website shutdowns have been publicly confirmed. The NCSC told businesses to patch immediately or consider taking affected systems offline and sent 50,000 warnings. Lloyd said the NCSC was briefed by OpenAI the previous week and coordinated disclosure with vendors. Security firm Calif found one flaw using OpenAI's GPT-5.6 Sol model, while Google's Wiz found both flaws; OpenAI then did its own analysis and helped coordinate. AWS says attackers began exploiting the flaws four days before they were publicly disclosed, and Cloudflare has recorded millions of exploitation attempts.

Update, October 22, 2026

CivicPlus, a government software provider, shut down its municipal website platform on Wednesday after learning of a PHP security vulnerability. The company said all editions of Web Open were taken offline, while its Community Development software had version 3 down and version 4 restored but still being monitored. CivicPlus's incident notice linked the action to a PHP flaw but did not name the specific issue or say whether it had been exploited. The company said it had no evidence that customer data was compromised. Naples, Florida, officials said the city's website went offline because of a suspected security vulnerability and that restoration was underway. Links to City Council agenda items through the city's Granicus system were also unavailable, and the city directed viewers to Naples TV for the meeting. CivicPlus had not named all affected municipalities or given a customer count, and Web Open remained offline Wednesday afternoon with no restoration estimate.

Update, October 23, 2026

Cloudflare saw no confirmed successful exploitation despite the surge in attempts, and Amazon said exploit attempts against its honeypots also produced no evidence of success. Ox Security found that 24 hours after patches shipped, 99% of PHP hosts it could fingerprint through Shodan were still on an unpatched version. VulnCheck said it produced a working exploit for CVE-2026-109618 that gets around ASLR on x86-64 and is sharing it only with selected customers; its scans found more than 1.1 million hosts on unsupported PHP releases plus another 403,000 running releases 8.2 through 8.5 that remain patchable. The two flaws are distinct: CVE-2026-109619 is a use-after-free in the upload progress code, while CVE-2026-109618 is memory corruption when PHP runs out of memory, according to Akamai. Security experts in the same report said patching is the only reliable mitigation.

Amazon CISO CJ Moses wrote that a honeypot logged an exploit attempt on October 17 from an anonymized IP, before details became public. PHP Foundation executive director Elizabeth Barron said "to our knowledge, there has been no successful attempt at remote code execution". The foundation initially theorized the bug in 2024, but a fix was delayed because candidate patches caused backward compatibility breaks, new denial-of-service potential, or required changes to many third-party extensions. It is changing processes so serious vulnerabilities with hard trade-offs reach leadership sooner.