CISA urges immediate patching of critical 'php2shell' PHP flaws leaked before a fix existed
The leak removed the usual head start defenders get from coordinated disclosure, so internet-facing PHP systems should be treated as potentially exposed since 20 October, not just since the patch date. The hardest cases are legacy applications pinned to PHP 8.1 or earlier, where CISA's guidance amounts to an availability decision rather than a maintenance task. Executives should expect to make that trade-off explicitly, and should press hosting providers and SaaS vendors for written confirmation of their patch status.
What Happened
On 21 October 2026 CISA urged organisations to patch CVE-2026-109618 and CVE-2026-109619 ('php2shell') immediately, saying the flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests. CISA advised moving to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and said anyone who cannot update, or who runs PHP 8.1 or earlier, should take PHP-based systems offline until patched. Huntress reported that details of both flaws leaked online on 20 October, before coordinated disclosure and before patches existed; PHP's security team rates each 9.2 on CVSS v4.0.
Why It Matters
The leak removed the usual head start defenders get from coordinated disclosure, so internet-facing PHP systems should be treated as potentially exposed since 20 October, not just since the patch date. The hardest cases are legacy applications pinned to PHP 8.1 or earlier, where CISA's guidance amounts to an availability decision rather than a maintenance task. Executives should expect to make that trade-off explicitly, and should press hosting providers and SaaS vendors for written confirmation of their patch status.
Sources
- Cybersecurity and Infrastructure Security Agency (CISA) (opens in a new tab): Critical Vulnerabilities in PHP Require Immediate Patching (2026-10-21)
- Huntress (opens in a new tab): Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) (2026-10-20)
- Help Net Security (opens in a new tab): PHP2Shell: Critical PHP vulnerabilities patched, update now! (2026-10-21)
More From This Briefing
- Compromised LiteLLM release targeted cloud, developer and AI provider credentials
- US, UK and German agencies issue joint #StopRansomware advisory on SafePay
- Nvidia unveils prefabricated DSX pods and waterless data centre specifications
- ISG study for Bermuda-based mea finds 86% of insurers would rework outsourcing deals for AI
This story is part of the Laurenceo Intelligence briefing for 22 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.