Critical Vulnerabilities in PHP Require Immediate Patching
Updated 3 hours ago ()
Update October 23, 2026: CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance. Purpose CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication, they pose a risk to organizations if left unpatched. Actions to Take CISA urges organizations to take the following actions: Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software and prevalence may not be directly observable. A…
- Tags
- CISA
- Related exam domains
- CISSP 7: Security Operations; CISSP 8: Software Development Security; CISM 2: Information Security Risk Management; CISA 3: Information Systems Acquisition, Development and Implementation; CISA 4: Information Systems Operations and Business Resilience
- Source record id
- /node/25669
- First seen by InfoSec Signals
- Oct 21, 2026
Source: CISA cybersecurity advisories, Cybersecurity and Infrastructure Security Agency about this source more from it
Exam domain labels come from a keyword heuristic and are study hints, not an official mapping. The summary is the publisher's own text, shortened; the linked record is authoritative.