Two critical flaws in PHP, known as "php2shell", let an attacker run code remotely without logging in. They affect PHP installations that serve web requests. CISA and the UK NCSC both put out urgent alerts on 21 October. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October, after seeing evidence that they are being used in attacks. Affected products and IDs PHP versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older is not supported. CVE-2026-109618 and CVE-2026-109619. Exploitation status Being exploited. Both flaws were added to CISA KEV on 26 October 2026. Why it matters to OT operators PHP is often built into vendor appliances, web consoles and DMZ systems near industrial networks, so a site may be running it without knowing. CISA advises finding every PHP installation (including ones built into other products), patching internet-facing systems first, taking PHP 8.1 and older offline, considering a web application firewall as a stopgap, and watching for PHP worker processes starting shells. The NCSC also advises checking for compromise and backdoors, and asking appliance vendors about their fixes. Sources CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", 21 Oct 2026 (revised 26 Oct) CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog", 26 Oct 2026 NCSC, "Critical security issue affecting PHP", 21 Oct 2026 (updated 23 Oct) Source dates: 21 Oct 2026 (revised 26 Oct); 26 Oct 2026; 21 Oct 2026 (updated 23 Oct).
Two critical flaws in PHP, known as "php2shell", let an attacker run code remotely without logging in. They affect PHP installations that serve web requests. CISA and the UK NCSC both put out urgent alerts on 21 October. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October, after seeing evidence that they are being used in attacks. Affected products and IDs PHP versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older is not supported. CVE-2026-109618 and CVE-2026-109619. Exploitation status Being exploited. Both flaws were added to CISA KEV on 26 October 2026. Why it matters to OT operators PHP is often built into vendor appliances, web consoles and DMZ systems near industrial networks, so a site may be running it without knowing. CISA advises finding every PHP installation (including ones built into other products), patching internet-facing systems first, taking PHP 8.1 and older offline, considering a web application firewall as a stopgap, and watching for PHP worker processes starting shells. The NCSC also advises checking for compromise and backdoors, and asking appliance vendors about their fixes. Sources CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", 21 Oct 2026 (revised 26 Oct) CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog", 26 Oct 2026 NCSC, "Critical security issue affecting PHP", 21 Oct 2026 (updated 23 Oct) Source dates: 21 Oct 2026 (revised 26 Oct); 26 Oct 2026; 21 Oct 2026 (updated 23 Oct).