---
title: US Authorities Urge Immediate Fix for PHP Vulnerabilities
url: https://www.dataloco.com/en/us-authorities-urge-immediate-fix-for-php-vulnerabilities
published: 2026-10-24T19:20:31+00:00
language: en
section: Security
source: https://www.security-next.com/191766
organizations: cisa, php
publisher: Dataloco
---

# US Authorities Urge Immediate Fix for PHP Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has strongly recommended the immediate application of patches for two critical vulnerabilities found in the programming language PHP. If updates are not feasible, the agency advises taking systems offline.

The alert was issued on October 21, 2026, local time. The vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, also referred to as php2shell, affect all environments that process web requests using PHP. CISA has warned that there is a risk of arbitrary code execution remotely without requiring authentication.

At the time of the advisory's release, CISA reported that exploitation of these vulnerabilities had not been observed. However, organizations were urged to inventory their use of PHP and to update immediately to the patched versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

CISA emphasized prioritizing responses for systems connected to the internet and urged caution for systems that have PHP integrated. While a web application firewall (WAF) may provide some level of protection, the agency indicated that systems running PHP must operate offline until they are updated to the patched versions or have the patches applied.

Monitoring for behavior indicative of attacks is also recommended, with particular attention to instances where shell processes are spawned from PHP worker processes or when tools are downloaded.

## This story in other languages

- [Türkçe](https://www.dataloco.com/tr/cisa-phpdeki-kritik-guvenlik-aciklarini-acilen-duzeltme-cagrisinda-bulundu)
- [Nederlands](https://www.dataloco.com/nl/cisa-raadt-onmiddellijke-correctie-van-php-kwetsbaarheden-aan)
- [Norsk](https://www.dataloco.com/no/amerikanske-myndigheter-anbefaler-umiddelbar-utbedring-av-sarbarheter-i-php)
- [Português (Brasil)](https://www.dataloco.com/pt-br/cisa-recomenda-correcao-imediata-de-vulnerabilidades-no-php)