Critical Vulnerabilities in PHP Require Immediate Patching

CISA warns of two critical PHP vulnerabilities called “php2shell” (CVE-2026-109618 and CVE-2026-109619) that enable unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations are urged to immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, inventory PHP systems, prioritize internet-facing hosts, consider temporary mitigations such as web application firewalls or taking systems offline if they cannot be patched, and monitor for suspicious PHP activity; CISA reports no observed exploitation at time of publication.