CISA urges immediate patching of PHP2Shell flaws in PHP, used by 69.3% of websites

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged organisations to patch two critical vulnerabilities in PHP immediately. The flaws, CVE-2026-109618 and CVE-2026-109619, are known as “PHP2Shell”. This follows the PHP project’s emergency security updates on 21 October.

In an alert dated 21 October, CISA said the flaws allow unauthenticated remote code execution and affect all PHP installations that serve web requests. Wiz Research, one of the teams that found the flaws, said their severity reaches a CVSS score of 9.2.

What PHP is and why it matters

PHP is a server-side programming language: it runs on web servers and builds the pages that visitors’ browsers receive. According to W3Techs, PHP is used by 69.3% of all websites whose server-side programming language is known (figures dated 22 October 2026). W3Techs describes WordPress as a content management system based on PHP and says it runs 39.6% of all websites. Wiz said PHP also underpins Joomla, Drupal and MediaWiki, the software behind Wikipedia.

The flaws

According to Akamai, CVE-2026-109619 is a use-after-free flaw in PHP’s upload progress feature, and CVE-2026-109618 is memory corruption triggered by an out-of-memory condition. The Canadian Centre for Cyber Security said successful exploitation could allow an unauthenticated attacker to run arbitrary code on an affected system. Wiz said every PHP version released in the last decade, back to 5.4, is affected by at least one of the flaws.

Akamai said PHP announced on 20 October that it would release a patch on 21 October at 14:00 GMT. Details were due to be disclosed on 22 October, but information including the CVE IDs leaked early, Akamai said.

Exploitation status

Reports on attacks differ. BleepingComputer reported that Cloudflare chief technology officer Dane Knecht said the company was seeing early attacks targeting the flaws before the patches were released. CISA said in its alert that it had not observed exploitation of the vulnerabilities as of publication.

What administrators are advised to do

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (CISA, PHP security team).
• PHP 8.1 and older no longer receive official updates. The PHP team released minimal source backports for PHP 7.4, 8.0 and 8.1, and advised contacting distribution or LTS vendors or upgrading to a supported version (BleepingComputer).
• Identify all systems running PHP, including software that contains it, and prioritise internet-facing systems (CISA).
• Take PHP-based systems offline if they cannot be updated immediately or run PHP 8.1 or earlier (CISA). The UK National Cyber Security Centre gave similar advice to update or take systems offline until protected.
• A web application firewall may give some protection until systems are patched (CISA). The PHP team said temporary mitigations, such as setting session.upload_progress.enabled=0, reduce but do not remove exposure.
• Monitor for PHP worker processes launching shells or downloading tools (CISA).

Social media posts about the flaws have used terms such as “internet lockdown” and “Black October”. None of the official advisories cited here use those terms, and none names a government or bank that has taken websites offline.