NSA, CISA Urge Immediate Patching of Critical 'PHP2Shell' Vulnerabilities

The flaws sit in PHP itself, not in hosted applications, and could let attackers take over web servers without logging in

CISA has not seen exploitation yet, but NSA expects attackers to weaponize the flaws

Systems that cannot be patched right away should be taken offline

The National Security Agency and the Cybersecurity and Infrastructure Security Agency are urging organizations to immediately patch two critical PHP vulnerabilities that could let attackers take control of web servers without logging in, the agencies said Wednesday.

The flaws, collectively nicknamed “PHP2Shell,” affect PHP installations that serve web requests. CISA said it had not observed exploitation , but NSA said cyber actors are likely to weaponize the vulnerabilities.

What Are the PHP2Shell Vulnerabilities?

PHP runs on web servers across most major operating systems and can be embedded in HTML to create dynamic web pages. Because the flaws sit in PHP itself rather than in hosted applications or their configurations, any server running an affected version can be exploited, according to NSA.

The PHP project’s security advisory identifies two remote code execution flaws:

CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially set up, causing cleanup routines to treat invalid data as valid.

CVE-2026-109619: Internal state tied to one request can persist after its memory is freed, allowing a later request on the same worker to use that stale state.

The advisory covers setups including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP security team rated mod_php the highest risk, citing a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.

NSA warned that successful attacks could let intruders steal sensitive data, disrupt services or move deeper into networks. The agency said the risks warrant immediate patching across U.S. government departments and agencies.

What Should Organizations Do?

PHP released fixes Wednesday in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Linux distributions and long-term support vendors received patches in advance. Because PHP 8.1 and older versions no longer receive official updates, the PHP security team issued limited emergency backports for versions 7.4 through 8.1.

Both agencies advised organizations to inventory systems that rely on PHP. CISA noted that PHP is often embedded in other software and recommended prioritizing internet-facing systems. Other recommendations from the two agencies include:

Adding enhanced logging across network environments

Monitoring for suspicious activity, such as PHP worker processes launching shells or downloading tools

Replacing end-of-life PHP services that cannot be patched

Using a web application firewall for partial protection until updates are applied

Organizations that cannot update right away should take affected systems offline until they are fixed, the agencies said. CISA extended that advice to systems running unsupported PHP versions. The PHP advisory lists interim configuration changes that reduce exposure to specific attack paths but warns that only an update fully resolves the flaws.

NSA said it will continue working with CISA and other intelligence community experts to identify and address vulnerabilities affecting U.S. government systems.