The US Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to implement PHP (PHP Hypertext Preprocessor) patches after observing exploits in the wild.
CISA added the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) database on 26 October.
The agency has set a 29 October deadline for Federal Civilian Executive Branch (FCEB) agencies to implement patches, adding that it “encourages all organizations” to follow suit where possible.
“CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619,” CISA said in its advisory.
“These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.”
With the deadline fast approaching, federal agencies will be required to update to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
CISA’s advisory comes after the vulnerabilities sent the security industry, and indeed much of the web, into a frenzy last week.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
PHP is a programming language used in web development and underpins up to 70% of websites globally.
On 20 October, maintainers of the language, The PHP Foundation, issued an advisory warning of an impending patch after the critical vulnerabilities were discovered by security researchers.
While the patch landed on Wednesday, the incident sparked widespread disruption and panic amidst reports that the vulnerabilities were being actively exploited.
As reported last week, Cloudflare CEO Matthew Prince said the company saw “thousands of attempts to exploit it” in the hours before it was publicly announced.
“Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”
In its advisory, CISA outlined a series of actions that organizations can take to limit exposure, including:
- Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software, and its prevalence may not be directly observable.
- Apply the patch immediately, prioritizing internet-facing systems.
- Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
- A web application firewall may provide some protection until systems are updated or patched.
- Review the official PHP security advisory for guidance on patching.
- Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
Ramy Rahman, senior principal solutions engineer at ArmorCode, said that although federal agencies might face a tight deadline, it’s certainly possible to meet this “with the right resources”.
“The biggest challenge will be the versions of PHP they’re running, and the dependencies tied to them,” he said.
“Administrators should prioritize upgrading to the patched versions of PHP, including 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch.
"The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes.”
For systems that cannot be patched immediately, Rahman said: “compensating controls need to be applied to reduce exposure”.
This includes disabling vulnerable functionalities, restricting access, and taking systems offline if they cannot be adequately protected. The latter of these was recommended by security agencies last week, including CERT-EU and the UK’s National Cyber Security Centre (NCSC).