Critical Vulnerabilities in PHP Require Immediate Patching

Critical Vulnerabilities in PHP Require Immediate Patching | CISA

Cybersecurity and Infrastructure Security Agency CISA·cisa.gov·5 days ago

#security #cisa #vulnerabilities #organizations #critical

Reading 0:00

15s threshold

Update October 23, 2026 :

CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.

Purpose

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php ( Note : PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Create free account Log in

Menu

Critical Vulnerabilities in PHP Require Immediate Patching | CISA