Critical Vulnerabilities in PHP Require Immediate Patching
Critical · CVSS 9.2
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.
Remediation
Apply the updates and mitigations in the source advisory; if no fix is available, follow the advisory's guidance on restricting or discontinuing use.
Affected PHP branches
{'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'}
Source: CISA Cybersecurity Advisories · retrieved 2026-10-22T10:19:14-04:00 · https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching