Global cybersecurity agencies urge organizations to immediately patch two critical PHP vulnerabilities that could enable unauthenticated remote code execution on vulnerable web servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, affect PHP installations serving web requests and could allow attackers to execute malicious code without prior access.
In a joint statement issued Oct. 21, the European Union Agency for Cybersecurity (ENISA), the European Commission, CERT-EU, Europol’s European Cybercrime Centre and the EU national computer security incident response teams urged organizations to identify affected applications, prioritize internet-facing systems and coordinate remediation with hosting and service providers.
“Organisations should identify their PHP-based applications, coordinate with hosting and service providers, and apply the released security updates. Prioritise internet-facing systems,” the agencies wrote. “Where immediate remediation is not feasible, consider isolating exposed applications from public networks until fixes can be applied.”
They added that many commercial and open-source products rely on PHP in the background. “As a result, some may be affected by these vulnerabilities even if they do not appear to use PHP directly. We recommend checking the NCSC-NL GitHub repository for information on third-party software that includes PHP and may be impacted.”
The disclosure lands as new EU rules take effect. Since Sept. 11, 2026, manufacturers of hardware and software products must report actively exploited vulnerabilities through the Single Reporting Platform under the Cyber Resilience Act (Regulation (EU) 2024/2847). The main requirements take effect on Dec. 11, 2027. Manufacturers of products with digital elements must build security in by design and support those products throughout their lifecycle. That includes remediating vulnerabilities without delay.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urges organizations to immediately patch the critical PHP vulnerabilities. Known as ‘php2shell,’ the flaws allow unauthenticated remote code execution. They affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. PHP considers mod_php the highest risk.
On Friday, CISA updated its alert to provide a SIGMA detection rule to help identify potentially suspicious activity; incorporate partner resources; and reinforce existing mitigation guidance.
CISA recommends updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Organizations unable to patch immediately should take vulnerable PHP-based systems offline until they can be secured. CISA has not observed successful exploitation in the wild as of publication, but the flaws pose a risk to any organization that leaves them unpatched.
The agency also urges organizations to inventory all systems running any version of PHP. PHP often runs as part of other software, so its prevalence may not be directly visible. Organizations should apply the patch immediately and prioritize internet-facing systems. Those that cannot update right away, or that still use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. A web application firewall may offer some protection in the meantime. Security teams should also review the official PHP security advisory for patching guidance.
CISA also advises monitoring for suspicious activity. That includes PHP worker processes launching shells or downloading tools.
The U.K. National Cyber Security Centre also called upon organizations to inventory PHP installations, assess potential compromise and monitor third-party products that may bundle the language.
It added that the security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) reported that the PHP Foundation has published advance notice of critical vulnerabilities. The agency recommends that organisations monitor for the release of relevant patches. ASD’s ACSC is aware of media reporting that identifies the PHP flaws. No official technical details have been publicly released at this time.
“ASD’s ACSC understands that all PHP versions from PHP 5 onwards may be affected,” the advisory added. “ASD’s ACSC is not aware of successful active exploitation within Australia related to these vulnerabilities.”
Australian government websites, including those operated by the Australian Signals Directorate (ASD), were among the systems affected by two critical vulnerabilities in the widely used PHP programming language, prompting cybersecurity agencies worldwide to urge immediate patching. The flaws could allow attackers to execute malicious code on vulnerable web servers without authentication, raising concerns about widespread exposure across government services, commercial websites and online platforms.
Australian authorities said some government websites were temporarily taken offline while operators applied mitigations, while cybersecurity agencies in Europe and other countries also reported precautionary shutdowns. The vulnerabilities affect PHP, which underpins major content management systems and an estimated 75% of websites whose server-side programming language can be identified, according to W3Techs.
The Canadian Centre for Cyber Security (Cyber Centre) also issued an advisory in response to the vendor advisory on critical PHP vulnerabilities. These flaws are ‘Use After Free’ vulnerabilities (CWE-416) that affect multiple PHP versions and they could allow an unauthenticated threat actor to execute arbitrary code on an affected system. PHP servers and applications exposed to the internet face heightened risk.
“Organizations should identify affected systems and apply the appropriate updates immediately. PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide,” according to the Canadian agency. “All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows an unauthenticated request to trigger the vulnerability before application-level code is executed.”
The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.
Palo Alto Networks estimated that over 22 million exposed PHP instances could be affected, underscoring the potential scale of the exposure. The company also warned that the time required to patch widely deployed software could leave organizations vulnerable as attackers investigate newly disclosed flaws.
“PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately,” according to Palo Alto Networks’ Unit 42 threat intelligence team. “Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken its website offline as a precaution.”
Unit 42 researchers also observed attackers using agentic AI attack platforms for post-exploitation activity. In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation, they had successfully accessed password hashes and multi-factor authentication secrets. They also established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation.
