Cybersecurity Alert: Critical Vulnerabilities in PHP Require Immediate Patching

The Cybersecurity and Infrastructure Security Agency (CISA) published an alert strongly urging organizations to immediately patch recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 (collectively known as “PHP2Shell”). Because PHP is widely used on web servers and in HTML to create webpages, these security flaws can create an environment open to exploitation. Organizations should immediately update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities.

Schools and districts are advised to take the following actions as soon as possible:

• Identify and inventory systems running any version of PHP across your organization.

  • PHP is often a component of other software and prevalence may not be directly observable.

• Apply the patch immediately, prioritizing internet-facing systems.

• Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.

• A web application firewall may provide some protection until systems are updated or patched.

• Review the official PHP security advisory for guidance on patching.

• Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

If your school or district does not have a cybersecurity or information technology specialist to conduct the vulnerability patch, you can reach out to your service providers to share this information and inquire if they have conducted the necessary updates and patching steps.

If actions are not taken, these vulnerabilities could allow attackers to take control of affected web servers without prior access or authentication. Such an access vector could help attackers steal sensitive data, disrupt services, or move deeper into a network. These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration. Servers running affected PHP versions are exploitable.

Schools and districts are also encouraged to maintain heightened awareness of internet-facing devices and services that are reliant on PHP, and to monitor and publish patches from additional software vendors once they are available.

For additional details, please review the alerts from CISA, the National Security Agency and PHP.