WASHINGTON — The Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to patch two critical software vulnerabilities or take affected systems offline by today, after confirming the security flaws are being exploited by hackers.
CISA added the vulnerabilities, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities catalog Monday, Oct. 26, escalating the federal government’s response to threats affecting software widely used to operate websites and online applications.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP, an open-source programming language used by millions of websites, including those built with WordPress and Drupal.
According to CISA, flaws could allow attackers to remotely execute malicious code on vulnerable servers without needing a username or password, potentially enabling them to steal sensitive information, alter websites or compromise connected systems.
Three-Day Deadline
Under a federal cybersecurity directive, civilian agencies have three days to address the vulnerabilities. CISA also is requiring agencies to examine affected systems for evidence of previous compromise.
The agency warned that the vulnerabilities present significant risks to federal networks and urged private-sector organizations to take similar precautions, although the federal deadline does not apply to them.
CISA’s action represents a change from its initial assessment last week, when it said it had not observed exploitation of the flaws.
Patches Available, but Challenges Remain
The PHP development team released security updates Oct. 21 for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations using older, unsupported versions may face additional challenges in securing their systems.
CISA recommends prioritizing internet-facing systems and taking vulnerable installations offline when updates cannot be applied promptly.
The remediation effort could be particularly challenging for organizations that use PHP within third-party applications, embedded software or other systems where vulnerable components are not immediately apparent.
Cybersecurity specialists also caution that installing a patch may not be sufficient if attackers have already compromised a system. Organizations should review system logs and investigate suspicious activity to determine whether unauthorized access occurred before the vulnerabilities were corrected.
Extent of Attacks Remains Unclear
Security researchers have reported widespread attempts to exploit PHP2Shell, although the number of successful attacks remains uncertain.
Some cybersecurity companies have revised earlier assessments of successful intrusions after additional investigation. Nevertheless, CISA’s decision to include the vulnerabilities in its catalog indicates the agency has confirmed active exploitation.
CISA is encouraging all organizations to identify vulnerable systems, apply available security updates and investigate possible compromises.
