The Cybersecurity and Infrastructure Security Agency (CISA) has published an updated alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note : PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication, they pose a risk to organizations if left unpatched.
Organizations are urged to take the following actions:
- Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software and prevalence may not be directly observable.
- Apply the patch immediately, prioritizing internet-facing systems.
- Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
- A web application firewall may provide some protection until systems are updated or patched.
- Review the official PHP security advisory for guidance on patching.
- Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
Network defenders are advised to review the following advisories and resources and apply necessary updates:
- PHP’s Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now
- PHP’s Blog: Today's PHP Security Release, and How We're Strengthening PHP Security
- United States National Security Agency’s (NSA) Advisory: Critical Patches Recommended for PHP Vulnerabilities
- United Kingdom National Cyber Security Centre’s (NCSC-UK) Alert: Critical security issue affecting PHP
- Australian Signals Directorate’s Australian Cyber Security Centre’s (ASD’s ACSC) Alert: Critical vulnerabilities in PHP
- National Cyber Security Centre’s (NCSC-NL) GitHub repository: php2shell
- New Zealand National Cyber Security Centre’s (NCSC-NZ) NCSC encourages immediate patching against PHP vulnerability
- Canadian Centre for Cyber Security’s (Cyber Centre) Alert: Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
Organizations may also review CISA’s SIGMA detection rule to help identify potentially suspicious activity in relevant log sources (Note: CISA may update this resource as more information becomes available):