PHP2Shell Vulnerabilities Allow Web Server Takeover Without Login; U.S. CISA, NSA, and FBI Warn to Patch Immediately or Shut Down Servers

WASHINGTON

Two critical vulnerabilities that allow command execution on servers without authentication have been discovered in PHP, a programming language widely used in websites and web application servers, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) to successively urge immediate patching. From October 21 to 23 (U.S. time), the three agencies announced vulnerability IDs CVE-2026-109618 and CVE-2026-109619 through alerts, press releases, and a Public Service Announcement (PSA). All three shared the recommendation that organizations unable to update immediately should take the affected systems offline.

CISA States 'php2shell' Vulnerabilities Allow Unauthenticated Remote Code Execution

In an alert issued on October 21, CISA stated that the two vulnerabilities, dubbed "php2shell," enable unauthenticated remote code execution in PHP. All PHP installations serving web requests are affected. CISA cited Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed as examples. Among these, the mod_php combination was classified by PHP as highest risk, CISA added.

The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA stated that organizations should update to these versions immediately. However, CISA noted that as of the time the alert was published, it had observed no successful attacks in the wild exploiting these vulnerabilities. The CISA Cyber account posted the two vulnerability IDs on X the same day, notifying organizations that they must patch immediately.

CISA updated the alert on October 23, adding SIGMA detection rules to identify suspicious activity and incorporating materials from partner agencies. The partner materials include guidance from the United Kingdom's National Cyber Security Centre, the Australian Cyber Security Centre under the Australian Signals Directorate, the New Zealand National Cyber Security Centre, the Canadian Centre for Cyber Security, and the Netherlands National Cyber Security Centre.

On the same day, the NSA also issued an advisory through a separate press release.

NSA Warns Cyber Actors Likely to Weaponize Vulnerabilities

In a press release on October 21, the NSA stated that PHP developers released open-source patches that day (Wednesday). The NSA noted that PHP (short for 'PHP: Hypertext Preprocessor') runs on most major operating systems, executes directly on web servers, and is embedded in HTML to create dynamic web pages. Because it is so widely used, the NSA stated, this flaw could create an environment ripe for exploitation. The NSA dubbed this set of vulnerabilities "PHP2Shell" and stated it is prioritizing the identification of malicious cyber actors attempting to exploit them.

The NSA stated that an attacker could gain control of affected web servers without prior access or authentication. Through this path, an attacker could steal sensitive data, disrupt services, or pivot deeper into a network, the NSA added. The NSA stated that the vulnerabilities are flaws in PHP itself rather than in hosted applications or configurations, leaving servers running affected PHP versions exposed to attack.

The NSA, responsible for U.S. national security, stated that "Cyber actors are likely to weaponize the PHP2Shell vulnerabilities." Because of the critical risk, it said immediate patching is required across U.S. federal government departments and agencies. The NSA recommended maintaining vigilance over internet-exposed devices and services relying on PHP over the coming weeks, enhancing logging, and replacing end-of-life (EOL) PHP services incompatible with the patches. The NSA's cybersecurity account also posted the advisory on X the same day.

In the post, the NSA stated that these vulnerabilities often provide a direct path to the server's file system or database. It recommended taking systems offline if an immediate update is not feasible, adding that detailed guidance would be released shortly.

The NSA advised closely monitoring updates, noting that other software vendors may release patches as they become available, and stated that the latest mitigation guidance can be found on the PHP developers' security advisory page. The NSA stated it will collaborate with experts across the intelligence community and CISA to identify and remediate vulnerabilities in government and national security systems.

CISA Calls for Comprehensive Inventory of Systems Running PHP

CISA first called on organizations to identify all systems running PHP within their environments. Because PHP is frequently embedded inside other software, it may not be immediately apparent, CISA stated. CISA then urged immediate patching of internet-exposed systems first. Organizations unable to update immediately or those still running unsupported PHP 8.1 or earlier must take PHP-based systems offline until patching or updating is complete.

CISA urged reviewing official security notices from PHP developers to check patching instructions. Web application firewalls may provide some protection until systems are updated, CISA stated. CISA recommended monitoring for suspicious activity, such as PHP worker processes executing shells or downloading tools.

The FBI issued Public Service Announcement I-102326-PSA on October 23, following a social media post on October 21. The FBI stated that PHP is a widely used programming language powering websites and web applications, and that the two vulnerabilities could allow malicious cyber actors to remotely execute code in PHP core, placing sensitive data and networks at risk. The FBI Cyber Division posted this update on X on October 21.

The FBI stated that security updates are already available and should be applied immediately. When identifying where PHP is present, the FBI urged prioritizing internet-exposed systems and vendor products bundling PHP, and monitoring web servers for PHP processes unexpectedly launching command shells or downloading files. The FBI stated that the latest information is available in PHP developer advisories, the European Union's CERT-EU Security Advisory 2026-018, and CISA's Known Exploited Vulnerabilities (KEV) catalog. The FBI called on enterprises and website operators to verify whether their systems are affected. If signs of compromise are detected, it urged organizations to isolate affected systems, preserve web server and PHP logs, and report the incident to a local FBI field office or ic3.gov. The FBI stated that these reports assist law enforcement in identifying the actors responsible and warning other organizations before they are harmed.

Sources (KST)

• U.S. CISA, "Critical Vulnerabilities in PHP Require Immediate Patching" (Published October 21, 2026, Updated October 23): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• U.S. National Security Agency (NSA), "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities" (October 21, 2026): https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/
• U.S. Federal Bureau of Investigation (FBI), "Critical Vulnerability Alert: PHP Core" (Public Service Announcement I-102326-PSA, October 23, 2026): https://www.fbi.gov/investigate/cyber/alerts/2026/critical-vulnerability-alert-php-core
• CISA Cyber Account X Post: https://x.com/CISACyber/status/2112947079458717969
• NSA Cyber Account X Post: https://x.com/NSACyber/status/2112903220209098897
• FBI Cyber Division X Post: https://x.com/FBICyberDiv/status/2112921648252719420