The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning about two newly disclosed critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. These issues, referred to as “php2shell,” affect all PHP installations serving web requests.
According to CISA, these vulnerabilities enable unauthenticated remote code execution in PHP. This means an attacker can execute code on a vulnerable PHP system without authentication. CISA notes that, at the time of publication, it has not yet observed active exploitation, but stresses that the flaws pose a risk to organizations if left unpatched.
CISA recommends that organizations:
- Identify and inventory all systems running any version of PHP across their environment.
- If systems cannot be updated immediately, or if they continue to use PHP 8.1 or earlier unsupported versions, those PHP-based systems should be taken offline until they can be patched or updated.
- Review the official PHP security advisory for detailed patching guidance.
For embedded.az readers running web interfaces, dashboards, or APIs on PHP, any server processing web requests with PHP must be promptly updated or isolated to mitigate the "php2shell" risk.
Source: Gündəm · cisa.gov
