The two “php2shell” bugs affect PHP installations serving web requests; fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The US Cybersecurity and Infrastructure Security Agency on Wednesday urged organisations to patch two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, which together are known as “php2shell.” CISA says the flaws allow unauthenticated remote code execution and affect all PHP installations serving web requests, and that the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because PHP is often bundled inside other software, CISA tells organisations to inventory where it runs, patch internet-facing systems first, and take offline any system that cannot be updated or still runs PHP 8.1 or earlier, which no longer receives support. CISA said it had not observed exploitation at the time of publication. Canada’s Cyber Centre and CERT-EU have issued their own advisories.
Sources: CISA · Canadian Centre for Cyber Security · CERT-EU · Datadog Security Labs