---
type: "post"
id: "cisa-urges-immediate-patching-of-php2shell-php-flaws-b9b2c3"
slug: "cisa-urges-immediate-patching-of-php2shell-php-flaws-b9b2c3"
title: "CISA urges immediate patching of php2shell PHP flaws CVE-2026-109618 and CVE-2026-109619"
description: "CISA has urged organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as php2shell."
retrieval_nugget: "CISA has urged organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as php2shell."
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["security"]
entities: ["CISA","PHP","php2shell","Apache HTTP Server","FrankenPHP","LiteSpeed"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "CISA now urges immediate patching and has updated its alert with a SIGMA detection rule, partner resources, and reinforced mitigation guidance."
prior_refs: ["memory:592c9dc4-991d-8a8c-ae31-be347a0f42d2","memory:1fa7e39f-79f8-8659-a7be-09e2b4dab10c","memory:acb68224-002f-8afd-af9b-46a75a5e2db3","memory:477bebec-77d1-89f9-a55f-65ea0f90ac39","memory:b96fa1d6-a199-8ee5-a6d1-acf05be2ce9c"]
source_url: "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching"
source_urls: ["https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cisa-urges-immediate-patching-of-php2shell-php-flaws-b9b2c3"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/cisa-urges-immediate-patching-of-php2shell-php-flaws-b9b2c3/","markdown":"https://newruntime.com/posts/cisa-urges-immediate-patching-of-php2shell-php-flaws-b9b2c3.md","json":"https://newruntime.com/posts/cisa-urges-immediate-patching-of-php2shell-php-flaws-b9b2c3.json"}
---

# CISA urges immediate patching of php2shell PHP flaws CVE-2026-109618 and CVE-2026-109619

## Retrieval answer

CISA has urged organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as php2shell.

CISA has urged organizations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as php2shell. The October 21 alert was revised on October 23, 2026 to add a SIGMA detection rule, partner resources, and reinforce mitigation guidance.

CISA says the flaws allow unauthenticated remote code execution in PHP installations that serve web requests. It lists Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed among affected deployment types. The agency directs organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, prioritizing internet-facing systems.

Organizations unable to update immediately, including those on unsupported PHP 8.1 or earlier, are advised to take affected PHP systems offline until patched or updated. A web application firewall may provide partial temporary protection. CISA also advises monitoring for PHP worker processes that launch shells or download tools. The alert does not establish that the vulnerabilities have been successfully exploited in the wild; CISA said it had not observed such exploitation at publication.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)