The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. These flaws allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. The vulnerabilities pose a risk to organizations if left unpatched, as they enable attackers to execute arbitrary code on affected servers.

Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched. CISA urges organizations to take the following actions: Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software and prevalence may not be directly observable. Apply the patch immediately, prioritizing internet-facing systems. Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.

A web application firewall may provide some protection until systems are updated or patched. Review the official PHP security advisory for guidance on patching. Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools. CISA urges network defenders to review the following advisory and apply necessary updates: Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now. The German publication Heise reports that two errors make web servers with PHP vulnerable to attacks from the network, affecting versions from the last 20 years.

Sources

• PHP ships emergency patches for critical PHP2Shell flaws
• Critical Vulnerabilities in PHP Require Immediate Patching
• php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP