FBI public service announcement October 23, 2026; PHP fixes released October 21, 2026
PHP2Shell: The FBI Says Patch PHP Now or Take the System Offline
Two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, let an unauthenticated attacker run code on a server, and both are rated 9.2 under CVSS v4.0. Technical details and proof-of-concept code leaked on October 20, so PHP moved its fixes up a day to October 21: versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are fixed, while PHP 8.1 and older get no official patch. The FBI issued a public service announcement on October 23 urging immediate updates, and the FBI, NSA, and CISA all gave the same fallback advice: if you cannot update right away, take the system offline until you can. Cloudflare and watchTowr reported early exploitation attempts, neither CVE was on the CISA Known Exploited Vulnerabilities catalog as of October 21, and reporting over the weekend described governments and companies patching through the weekend, with some government websites in Britain, Finland, and Japan suffering outages or reduced service during the response.
Executives
PHP runs a large share of the public web, including WordPress, Drupal, Joomla, hosting panels, and vendor appliances your teams may not know they own. The federal advice here is unusually blunt, patch or unplug, which means the decision to keep an unpatched internet-facing system running is now a documented risk acceptance, not an IT scheduling choice.
CIO / CISO
Inventory PHP everywhere first, including products that bundle it, and prioritize internet-facing systems. Confirm the running build, not just the installed package, is at a fixed version, restart PHP workers after updating, and hunt back to October 17 for PHP processes launching shells or downloading files and for new files in web roots. For PHP 8.1 and older, the options are upgrade, offline, or a written exception with compensating controls.
Engineers
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or your distribution backport, and verify with php -v and the running FPM pools, then restart Apache, LiteSpeed, or PHP-FPM so the fixed build actually serves traffic. Servers running PHP as an Apache module are at the highest risk. A web application firewall rule is a stopgap only, and it does not make an unpatched site safe.
Everyone (non-IT)
If you run a small website, especially WordPress, ask your host today which PHP version your site runs and whether it was updated this week. If the host cannot answer, that silence is itself a warning sign, because attackers are scanning for exactly these servers.