Critical PHP Vulnerabilities (php2shell) – Immediate Patching Required
Published: October 21, 2026
Applies to: All PHP installations serving web requests
Severity: Critical
CVEs: CVE-2026-109618, CVE-2026-109619
Overview
CISA has issued an urgent advisory for two critical remote code execution vulnerabilities in PHP, collectively known as php2shell. These flaws allow unauthenticated attackers to execute arbitrary code on vulnerable systems and affect all PHP installations that process web requests.
While no active exploitation has been observed at the time of the advisory, the risk is high for any internet-facing PHP application that remains unpatched.
Affected Versions
All PHP versions prior to the fixed releases are vulnerable. This includes currently supported branches as well as older, unsupported versions (PHP 8.1 and earlier).
Fixed Versions
Update immediately to one of the following releases:
| PHP Branch | Fixed Version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Recommended Actions
- Inventory all systems running PHP (including those embedded in other software or applications).
- Patch immediately, prioritizing any internet-facing servers or applications.
- If you cannot update right away, or if you are still running PHP 8.1 or earlier:
- Take the PHP-based systems offline until they can be patched or upgraded.
- A web application firewall (WAF) may offer limited temporary protection but is not a substitute for patching.
- After updating, verify the PHP version and restart the web server / PHP-FPM / FastCGI processes so the new version is active.
- Monitor logs for suspicious activity, such as PHP worker processes spawning shells or making unexpected outbound connections.
Hosted DNS Texas Customers
DNS Texas is reviewing managed systems and will apply the appropriate PHP updates as quickly as possible. Customers who self-manage their PHP environments should update immediately using the versions listed above. For assistance verifying your PHP version or applying the update, [open a service request] through the DNS Texas portal.
References
- [CISA Advisory: Critical Vulnerabilities in PHP] Require Immediate Patching (October 21, 2026)
- Official [PHP security advisory]
DO NOT DELAY!
These are critical, unauthenticated remote code execution vulnerabilities.
Update as soon as possible.
