Critical Vulnerabilities in PHP Require Immediate Patching

Descripción

CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.  CISA urges organizations to take the following actions: Identify and inventory systems running any version of PHP across your organization.  PHP is often a component of other software and prevalence may not be directly obse

CVEs mencionados

• CVE-2026-109618
• CVE-2026-109619

Fuente oficial

Alerta publicada por CISA / US-CERT. Consulta el advisory completo para detalles técnicos, indicadores de compromiso y mitigaciones específicas.