The October 21 alert was revised on October 23, 2026 to add a SIGMA detection rule, partner resources, and reinforce mitigation guidance.
CISA says the flaws allow unauthenticated remote code execution in PHP installations that serve web requests. It lists Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed among affected deployment types. The agency directs organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, prioritizing internet-facing systems.
Organizations unable to update immediately, including those on unsupported PHP 8.1 or earlier, are advised to take affected PHP systems offline until patched or updated. A web application firewall may provide partial temporary protection. CISA also advises monitoring for PHP worker processes that launch shells or download tools. The alert does not establish that the vulnerabilities have been successfully exploited in the wild; CISA said it had not observed such exploitation at publication.