Critical Vulnerabilities in PHP Require Immediate Patching

CISA is urging organizations to immediately patch two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as 'php2shell'. These vulnerabilities allow unauthenticated remote code execution and affect all PHP installations serving web requests. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations unable to patch immediately should take PHP-based systems offline, especially internet-facing ones. PHP 8.1 and earlier unsupported versions are also affected. CISA recommends inventorying all PHP installations, applying patches with priority to internet-facing systems, and using web application firewalls as a temporary mitigation. Network defenders should monitor for suspicious activity such as PHP worker processes launching shells or downloading tools. No active exploitation has been observed at the time of publication.