PHP2Shell Exploitation Confirmed: CISA Gives Federal Agencies Three Days to Patch

The grace period is over. On October 27, 2026, CISA confirmed that hackers are actively exploiting two critical PHP vulnerabilities and ordered U.S. civilian federal agencies to patch their systems within three days.

The bugs, designated CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, allow unauthenticated remote code execution. An attacker who knows how to exploit them can break into a system running PHP without a password, then access or modify its data. The PHP Foundation released emergency patches on October 21, 2026. Every PHP version released in the last decade is affected, going back to 5.4.

PHP powers roughly 70% of websites. It underpins WordPress, Joomla, Drupal, and MediaWiki, which means the exposure is not confined to bespoke applications. Any organization running an unpatched PHP stack is now a live target for compromise, disruption, and data breach.

The warning signs were there. The NSA recommended that organizations inventory PHP-reliant systems and prioritize vendor patches. Some governments and large companies took sites offline rather than risk running vulnerable code while they remediated. Security researchers said developing a working exploit was initially challenging, but not impossible. That assessment has now been overtaken by confirmed exploitation.

The flaws had been dormant for years and were found by human researchers, not AI models. That detail matters: the discovery was the product of sustained manual analysis, not automated scanning at scale. The exploitation that followed is a separate phase, and it is the one defenders are now in.

CISA's three-day deadline for federal civilian agencies signals the severity. It is an unusually short window, and it reflects a judgment that the risk of waiting exceeds the operational cost of emergency patching.

Version 5.4 and later are all in scope.

Apply the patches released on October 21. If patching cannot be completed immediately, take affected systems offline rather than leave them exposed.