CISA and NSA urge immediate patching of critical PHP remote code execution flaws (php2shell)
PHP is often embedded inside other software, so the hard part is finding every instance, not applying the fix. Organizations that have not yet mapped their PHP exposure, including third-party and vendor-managed applications, should start now. The absence of observed exploitation today is a narrow window, not a safe position.
What Happened
CISA published an alert urging organizations to patch CVE-2026-109618 and CVE-2026-109619, known as "php2shell". The flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; CISA said it had not observed exploitation at the time of publication, while ExecutiveGov reports that NSA expects attackers to weaponize the flaws.
Why It Matters
PHP is often embedded inside other software, so the hard part is finding every instance, not applying the fix. Organizations that have not yet mapped their PHP exposure, including third-party and vendor-managed applications, should start now. The absence of observed exploitation today is a narrow window, not a safe position.
Sources
- CISA (opens in a new tab): Critical Vulnerabilities in PHP Require Immediate Patching (2026-10-21)
- ExecutiveGov (opens in a new tab): NSA, CISA Urge Immediate Patching of Critical 'PHP2Shell' Vulnerabilities (2026-10-22)
More From This Briefing
- Microsoft exits lease at Nscale site over grid delay but keeps US$30bn UK investment plan
- Moonshot AI publishes Kimi K3.1 Pro, with full weights promised by 4 November
- BMA publishes updated guidance note for general business SAC insurers, effective 1 January 2027
- Bermuda-based mea study: 86% of insurance outsourcing buyers would renegotiate for AI efficiency
This story is part of the Laurenceo Intelligence briefing for 24 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.