US warns over PHP as CISA and FBI urge shutdown of unpatched systems

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI called for urgent updates to address two critical vulnerabilities known as “PHP2Shell” in PHP, which is used by about 70% of websites. Public websites in Japan and some European countries were temporarily taken offline.

Scraper SystemOctober 22, 2026, 07:19 PM

US warns over PHP as CISA and FBI urge shutdown of unpatched systems

In an alert published on October 21, the US Cybersecurity and Infrastructure Security Agency (CISA) said two critical vulnerabilities identified in the PHP programming language and dubbed “php2shell” — CVE-2026-109618 and CVE-2026-109619 — enable remote code execution without authentication and affect all PHP installations that serve web requests.

CISA urged system owners to immediately upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35. It said those unable to update immediately, as well as users of version 8.1 and earlier releases that are no longer supported, should take their PHP-based systems offline until they are patched. The agency said it had not observed the vulnerabilities being exploited when the alert was published.

FBI: Take the system offline

FBI headquarters in Washington

The FBI also said the vulnerabilities could allow “malicious cyber actors to execute remote code in the PHP core” and recommended that, if an update could not be applied immediately, “the system be taken offline until the issue is fully remediated.” The agency also advised closely monitoring PHP processes for unexpectedly launching a command shell.

According to W3Techs, PHP is used by 69.3% of websites whose server-side language can be identified, although the risk varies depending on the version and configuration. The vulnerabilities were independently identified by Wiz Research and Calif, a security startup that uses artificial intelligence models.

Websites taken offline in Japan and Europe

Following the alerts, Japan’s Ministry of Health, Labour and Welfare temporarily shut down the website of an information system for long-term care service providers. Some public institutions in Denmark, Norway, Finland and the Netherlands also partially or completely suspended access to their websites.

Source: Anadolu Ajansı

Have a story, event or announcement of your own?Send us your news on WhatsApp

Spotted an error in this story?Report it on WhatsApp

Share on all social platforms