Two serious flaws in PHP, a programming language used to run websites, can let an attacker run code on a web server without logging in. CISA urges organizations to patch CVE-2026-109618 and CVE-2026-109619 right away, a pair of bugs nicknamed "php2shell."
For a small firm, the fix is usually a version update. The harder part is finding every place PHP runs, since it often ships inside other software. This guide explains what is affected, which versions fix the problem and what to do if an update cannot happen today.
Key facts
- CISA says the two flaws allow remote code execution without any login.
- The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to CISA.
- Sites still on PHP 8.1 or older should go offline until updated, CISA says.
- The Center for Internet Security rates the risk high for large and medium businesses and medium for small ones.
- CIS expects working exploits to show up very quickly.
Background
According to CISA's alert, the flaws affect every PHP installation that serves web requests. That list includes Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. CISA notes that PHP itself sees mod_php as the highest-risk setup.
The CVE record for CVE-2026-109619 describes it as a use-after-free bug, cataloged as CWE-416. In plain terms, leftover global data from one web request can be picked up and reused by a later request. That record was published on October 21, 2026.
Scores for this flaw differ by system. NVD lists a CVSS 4.0 score of 9.2, rated Critical, supplied by PHP. NVD's own CVSS 3.1 score is 8.1, rated High.
At the time of its alert, CISA had not seen successful attacks in the wild, but it warned that unpatched systems remain at risk. Whether that has changed since the agency's later update is not known.
What it means for you
A website, online form, booking page or customer portal may run on PHP without the owner knowing it, because PHP is often bundled inside a content system, a plugin or a vendor's app. Sites built years ago and handed off are easy to lose track of, and a website refresh can be a chance to document what runs underneath.
CIS says a successful attack could let an intruder install programs, read, change or delete data, or create accounts with full rights. How much damage is possible depends on the privileges of the account the web service runs under, according to CIS.
A hacked web server can also become a doorway into the rest of a network. That is why patching a public website deserves the same urgency as patching office computers. If ransomware is a worry, the steps in our ransomware checklist for small firms pair well with this update.
Practical steps
These steps come from the CISA and CIS guidance.
- Make a full list of PHP systems. CISA advises an inventory of every system running PHP and reminds teams that PHP often hides inside other software. Check web servers, hosting accounts, internal tools and vendor appliances.
- Patch internet-facing systems first. CISA says public-facing systems should get priority. A public website or portal is the most likely target.
- Update to a fixed release. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as CISA directs. Ask a hosting provider to confirm the version if the server is managed by someone else.
- Check vendor packages for older branches. CIS cites PHP guidance that Linux distributions and long-term support vendors may offer patched packages for older versions. If none exist, moving to a supported branch is the only complete fix.
- Take unpatchable systems offline. CISA says systems that cannot be updated right away, or that run PHP 8.1 or older, should come offline until they are fixed.
- Use a stopgap only as a bridge. For CVE-2026-109619, CIS lists a temporary measure: set session.upload_progress.enabled=0 and restart every worker. CIS stresses that only an update fully solves the problem.
- Add a web application firewall and watch for warning signs. CISA says a firewall of this kind may give some protection until updates land. It also says to watch for PHP worker processes that launch shells or download tools.
Teams without in-house staff can lean on managed IT services for the inventory and patch work. Broader monitoring and firewall setup fall under our cybersecurity solutions. It also helps to have a tested way back if an update breaks a site, which our disaster recovery services are built for.
What happens next
CISA updated its alert on October 23, 2026, adding a SIGMA detection rule and partner resources from agencies that include the NSA and the UK's NCSC. Security teams can use that rule to look for signs of attack in their logs.
CIS expects exploits to appear in the wild very quickly. The safest path is to finish updates now and then keep checking the CISA alert page for new guidance.
