CISA: Critical Vulnerabilities in PHP Require Immediate Patching

What's on the official record

CISA published an alert on 21 October 2026 urging organizations to immediately patch two recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. CISA states these vulnerabilities, known as "php2shell," allow unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. CISA directs organizations to immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix the vulnerabilities.

Assessment

For a platform or AI-stack owner, the record names two CVEs with unauthenticated remote code execution affecting every PHP installation serving web requests. CISA's alert lets this reader check its PHP runtime estate against the named fixed versions and patch or isolate any instance below PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

For a cyber underwriter, the record identifies CVE-2026-109618 and CVE-2026-109619 as critical, with unauthenticated remote code execution across all PHP installations serving web requests. CISA's alert lets this reader check policyholders' PHP estates against the named fixed versions and require the control of patching to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 before binding or pricing.

What would change this call

A CISA update naming additional affected versions, a revised remediation date, or a vendor statement expanding the affected surface would change the patch and underwriting checks above.

What to check next

Confidence

Filed 25 October 2026 from the record dated 21 October 2026.

Sources

[1] Critical Vulnerabilities in PHP Require Immediate Patching — https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching