US and UK government agencies, including CISA, the UK’s National Cyber Security Centre and the FBI, have warned that two critical flaws in the PHP language runtime could let an unauthenticated attacker run code on a server over the network. CISA and the NCSC published alerts on 21 October and revised them on 23 October. The FBI’s internet crime centre followed with its own public service announcement on 23 October. The agencies tell organisations to find every PHP installation they run, starting with internet-facing systems, and to patch immediately.
What the flaws are
The two issues are tracked as CVE-2026-109618 and CVE-2026-109619. Both are memory-safety problems in PHP’s core. According to the NCSC, CVE-2026-109618 arises when out-of-memory handling interrupts PHP while internal request data is only partly initialised, so later cleanup treats invalid data as valid. CVE-2026-109619 lets request-owned internal state survive after its memory has been freed, so a later request on the same worker can use stale state. The NCSC says both can lead to memory corruption that could allow remote code execution without authentication.
CISA says the problems affect the usual ways of serving PHP: Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, and gives the flaws the nickname “php2shell”. The FBI announcement assigns the pair a CVSS score of 9.2. The other two documents give no score, so treat the exact number as provisional and the severity as critical either way.
Affected versions and fixes
The NCSC says all PHP versions are affected. CISA lists the fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What is confirmed and what is not
CISA states that as of its latest revision it has not observed successful exploitation in the wild. The NCSC alert gives no exploitation details. The FBI notice frames the flaws as a risk that could let malicious actors execute code remotely, and does not report confirmed attacks.
Our assessment: plan on attackers moving quickly once the details are understood. The flaws need no authentication, the exposed surface is the internet-facing web tier, and the fixes are public, which lets attackers compare patched and unpatched code.
Nothing in the published material identifies a threat actor, a victim or a campaign. Who found the flaws, and whether any attacker found them first, is not stated.
Beyond your own web servers
The NCSC and the FBI both stress inventory, prioritising internet-facing systems. The NCSC adds that many third-party products bundle their own copy of PHP, and tells organisations to watch for supplier patches, since an update to the system package will not reach a copy a vendor ships inside its own product. Our recommendation: where a supplier has published nothing, ask directly whether its product embeds PHP.
What to do, in order
- Find every PHP instance. Start with anything reachable from the internet, then work inward. Include containers and vendor-managed software.
- Patch internet-facing systems first. Move to the fixed release in your branch. Where a vendor ships its own PHP, apply the vendor’s update.
- Handle branches with no fix. Servers on a branch with no fixed release listed (CISA lists 8.2 to 8.5) need a migration plan. In the meantime CISA and the NCSC advise placing a web application firewall in front, or taking the service offline if neither updating nor mitigation is possible.
- Watch for post-exploitation behaviour. CISA tells defenders to monitor for PHP worker or web server processes that launch shells or download tools, and points to published SIGMA detection rules for this.
- Act on signs of compromise. The FBI advises isolating affected systems, preserving web server and PHP logs, and reporting to the local FBI field office or ic3.gov.
What we still do not know
The agencies have not said how readily the out-of-memory condition can be triggered remotely against hardened, memory-limited configurations, nor whether containers with strict memory caps make exploitation easier or harder. They have also not published a count of exposed hosts.
Source: Cybersecurity and Infrastructure Security Agency (CISA). Contains public sector information licensed under the Open Government Licence v3.0 (UK NCSC). Source: FBI Internet Crime Complaint Center (IC3).