PHP2Shell: patching the critical PHP vulnerabilities CISA flagged

What CISA says

CISA's alert on PHP covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that the alert calls "php2shell." CISA strongly urges organizations to patch both immediately.

The reason for the urgency is the type of flaw. CISA's alert says the vulnerabilities allow remote code execution without authentication.

The alert is not a report of active compromise. CISA says it had not seen successful exploitation in the wild when it published, but it still describes a risk for anyone who has not patched.

The alert has been revised. CISA's October 23, 2026 update added a SIGMA detection rule, and CISA says that the update also incorporates partner resources and reinforces its mitigation guidance.

Who is exposed

CISA does not limit exposure to one web server or one product. Its alert says the flaws affect every PHP installation that serves web requests, and it names the main ways PHP is run.

The same alert lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed as affected. It also notes that PHP considers Apache with mod_php the highest risk.

A second exposure problem is visibility. CISA's alert warns that PHP often sits inside other software, so a team may not see it by looking at its own server list.

CISA also treats older branches as a separate case. The alert singles out organizations that still run PHP 8.1 or earlier, which it calls unsupported versions. The fixed versions it names are in the 8.5, 8.4, 8.3 and 8.2 branches.

How to patch

CISA names four fixed versions.

The order of work in the alert is inventory first, then patch. Start by finding every system that runs any version of PHP.

Then patch, with internet-facing systems first.

For patching steps, CISA points readers to PHP's own advisory.

If a system cannot be updated right away, CISA gives two fallbacks. The first is the stronger one: take the PHP-based system offline until it can be patched. The same instruction applies to systems on PHP 8.1 or earlier. The second is weaker, and CISA words it with care: a web application firewall "may provide some protection" until patching is done.

CISA's wording does not present the firewall as an equal substitute for the patch. Teams that rely on one should read it as a stopgap, which is how the alert frames it.

Checking for exploitation

The alert gives one behavior to watch for.

CISA also offers a SIGMA detection rule, published in its SIGMA rules repository on GitHub. The alert says the rule is meant to help identify potentially suspicious activity in relevant log sources, and that CISA may update it as more information becomes available.

The alert also lists partner guidance, which security teams can use alongside CISA's. The sources are the NSA, NCSC-UK, ASD's ACSC, NCSC-NL, NCSC-NZ and the Canadian Centre for Cyber Security.

The alert does not describe a set of indicators of compromise or a method for confirming an intrusion beyond the monitoring item and the SIGMA rule. Teams should treat those two items as the full extent of CISA's detection guidance in this document.

The newly added KEV entries

Two other CISA alerts in the same period concern the Known Exploited Vulnerabilities (KEV) Catalog. On October 20, 2026, CISA added six entries.

Four of those are in Plex Media Server, one is in EG Secure Solutions SiteGuard Server Edition, and one is in Siemens Software Center.

On October 23, 2026, CISA added one more entry, in Arista VeloCloud Orchestrator.

CISA says KEV additions rest on evidence of active exploitation.

Neither KEV alert lists CVE-2026-109618 or CVE-2026-109619. That matches the PHP alert's statement that CISA had not observed successful exploitation.

How to rank the two

CISA's PHP alert and its KEV alerts do not set out one combined ranking, so the order below comes from the criteria CISA does state. Both KEV alerts point to Binding Operational Directive 26-04 for the federal civilian agencies it covers. The directive, as CISA describes it, tells agencies to move fastest on KEV-listed CVEs on publicly exposed assets that give total control after exploitation.

The same directive covers checking for earlier compromise. CISA says it sets basic expectations for when agencies must look for signs that attackers got in before the patch was applied.

Its scope is limited, but CISA still recommends the approach to others.

Putting these together, the PHP flaws and the KEV entries are both urgent, for different stated reasons. The KEV entries have documented exploitation. The PHP flaws allow unauthenticated code execution on a very common web component, which CISA calls critical and wants patched immediately. Teams should therefore not treat the lack of a KEV listing for the PHP CVEs as permission to wait. CISA's own PHP alert tells readers to patch now and to start with internet-facing systems.

What the documents leave open

The documents do not say whether CISA will add the PHP CVEs to the KEV Catalog. They only describe how entries qualify.

They also do not rank the six October 20, 2026 entries or the October 23, 2026 entry against the PHP flaws. They do not say how long organizations have to patch PHP, and they do not describe signs of compromise beyond the monitoring item above.

For a team that has to act, the sequence CISA does support is clear: inventory PHP, patch internet-facing systems to the named versions, take unpatchable systems offline, run the SIGMA rule and watch PHP worker processes for shells and tool downloads. Then check the new KEV entries against what you run, since several concern products that are not PHP at all.