IC Technology & Cyber — 2026-10-23

NSA and CISA Issue Joint Advisory Urging Immediate Patching of Critical PHP2Shell Vulnerabilities

BLUFCISA will very likely add the PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog by November 6, triggering mandatory remediation timelines for federal agencies while leaving organizations on unsupported PHP versions with no patch path.

CISA and NSA each issued advisories on October 21 urging immediate patching of the PHP flaws CVE-2026-109618 and CVE-2026-109619, nicknamed "php2shell," which allow unauthenticated remote code execution 12. CISA directs updates to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and said it had not observed exploitation at publication 1. NSA said cyber actors are likely to weaponize the flaws and advised taking systems offline if they cannot be updated immediately 2. The Epoch Times reported that Cloudflare CEO Matthew Prince posted on October 22 that exploitation attempts rose from thousands before the announcement to millions 3. It also reported that 32 UK government services were unavailable, as were several Dutch government sites and Denmark's Aula school platform 3.

Analysis
We have high confidence in this assessment because the CISA and NSA advisories agree on severity and remediation, and the reported jump in exploitation attempts fits active scanning. CISA will very likely add CVE-2026-109618 or CVE-2026-109619 to its Known Exploited Vulnerabilities catalog by November 6. Federal agencies would then face a binding remediation deadline, and civilian operators would have to treat the patch as a compliance item as well as a security fix. PHP often sits inside other software, so many organizations cannot see their exposure, and the government shutdowns in the UK, Netherlands and Denmark show what delay costs. Deployments on unsupported PHP 8.1 and earlier have no patch path and will stay exposed until replaced or taken offline. A catalog listing may still not come if the surge is mostly automated scanning without confirmed compromises, or if broad patching and shutdowns blunt exploitation before agencies can document it. That would leave the timeline to voluntary action and let teams stage updates by exposure.

4 sources

Critical Vulnerabilities in PHP Require Immediate Patching - CISA
NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities - National Security Agency/Central Security Service
US Cybersecurity Agencies Urge Immediate Fix for Bug Threatening Millions of Websites - The Epoch Times
NSA, CISA Urge Immediate Patching of Critical PHP2Shell Vulnerabilities - ExecutiveGov