NCCapital

**CISA Issues Urgent Warning Over Critical PHP Vulnerabilities That Could Let Hackers Take Over Web Servers**

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning urging organizations to immediately patch critical vulnerabilities in PHP, the programming language that powers millions of websites and web applications. The security flaws could allow attackers to execute malicious code remotely without authentication, potentially exposing sensitive data, compromising servers and disrupting business operations.

Published on October 21, 2026, the alert identifies two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively associated with an issue known as “PHP2Shell.” The vulnerabilities affect PHP installations serving web requests, making the warning particularly important for businesses, hosting providers and developers operating internet-facing websites.

According to CISA, the vulnerabilities create a serious risk for organizations that continue running unpatched versions of PHP. Remote code execution is particularly dangerous because it can allow an attacker to make a vulnerable server run unauthorized commands without first obtaining a legitimate account or logging in.

If successfully exploited, these weaknesses could potentially give attackers access to website files, application credentials, databases and other resources available to the compromised server. Depending on the environment and permissions involved, an intrusion could also provide a foothold for further attacks against connected systems.

CISA initially reported that it had not observed exploitation of the vulnerabilities when its October 21 advisory was published. However, the situation has since escalated. On October 26, CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that exploitation had been identified and increasing the urgency for organizations that have not yet applied the available fixes.

The PHP development team released patched versions addressing the flaws: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations running affected versions should upgrade to the corresponding patched release or a later supported version containing the fixes. Administrators should also verify that the update has been applied to every relevant PHP installation rather than assuming that updating one website or application protects an entire server.

CISA recommends that organizations inventory their systems to identify where PHP is installed, including applications and software packages that may bundle the language behind the scenes. Internet-facing systems should receive priority because they are directly accessible to potential attackers scanning the web for vulnerable targets.

For organizations unable to patch immediately, CISA recommends taking affected PHP-based systems offline until they can be secured. A web application firewall may provide some temporary protection, but it should not be treated as a replacement for installing the official security updates.

The warning is particularly relevant to small businesses and independent website operators, many of whom rely on shared hosting environments and may not regularly inspect their PHP versions. A website can remain exposed even if its visible pages appear to work normally, because the vulnerability exists in the underlying PHP runtime rather than necessarily in the website's own source code.

Developers and server administrators should also review logs for suspicious activity, including PHP worker processes unexpectedly launching command shells, downloading files or executing unfamiliar programs. Unexpected changes to website files, unfamiliar administrative accounts and unusual outbound connections may also warrant investigation. If a server shows signs of compromise, administrators should preserve relevant logs, isolate the affected environment and investigate before assuming that patching alone has resolved the incident.

The incident also highlights the importance of maintaining supported software versions. Organizations still using PHP 8.1 or earlier unsupported releases may be unable to obtain a straightforward security fix for their existing version. CISA advises taking vulnerable systems offline if they cannot be promptly updated, making modernization and migration planning an important part of long-term website security.

For website owners, the immediate priority is to determine which PHP version their hosting environment actually runs and confirm that the appropriate security patch is installed. Because PHP can be configured separately across hosting accounts, applications and server environments, checking a single website may not be sufficient. CISA's warning demonstrates how vulnerabilities in widely used infrastructure can quickly become a serious business risk—and why timely patching, continuous monitoring and supported software are essential to protecting websites and customer information.