WASHINGTON — The National Security Agency issued its formal advisory on October 21 recommending immediate inventory and patching of systems running PHP, or taking them offline if an update is not feasible, after the PHP project released fixes that day for two critical remote code execution vulnerabilities nicknamed PHP2Shell.
PHP Releases Emergency Patches for Two Critical Flaws That Let Attackers Run Code on Web Servers
CYBER — The PHP project shipped emergency updates on October 21, 2026, that fix two critical security flaws. These flaws can let an attacker run code on a web server that uses PHP, without needing a login or any credentials.
The Cybersecurity and Infrastructure Security Agency updated its alert on October 23 to reinforce the same actions, add a detection rule, and restate that organizations unable to update immediately should take PHP-based systems offline.
