PHP Vulnerability CVE-2026-109618 and CVE-2026-109619 (php2shell): What NYC SMBs Should Patch Now

If your business has a website, a client portal, an online store, or a booking page, there is a good chance it runs on PHP. PHP is the programming language underneath WordPress, many web-based business applications, and a long list of self-hosted tools. That is why a PHP vulnerability pair now on CISA’s exploited list matters to New York City small and midsize businesses, even ones that never think about the code behind their site.

On Monday, October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws allow unauthenticated remote code execution, which means an attacker does not need a login to run their own commands on an affected web server. The federal remediation due date for both is tomorrow, Thursday, October 29. Below is what NYC business owners and office managers need to know, using only what the PHP project and CISA have published.

What happened, in plain terms

On October 20, the PHP security team gave advance notice of a critical security release and said it addressed two vulnerabilities rated CVSS v4.0 9.2. On Wednesday, October 21, the project published its security advisory and shipped fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team’s message was blunt: all PHP users are strongly encouraged to update immediately, and updating is the only safe choice.

The same day, CISA published an alert titled “Critical Vulnerabilities in PHP Require Immediate Patching”. CISA notes the pair is known as “php2shell.” It updated the alert on October 23 with a detection rule and partner resources, and again on October 26 when both CVEs went into the KEV catalog. Government cyber agencies in the UK, Australia, the Netherlands, New Zealand, and Canada, along with the U.S. National Security Agency, have published their own guidance, which CISA links from its alert.

The two CVEs

• CVE-2026-109618, remote code execution through out-of-memory corruption. According to the PHP advisory, out-of-memory handling can interrupt PHP while internal request data is only partly set up. Request cleanup may then treat that invalid data as valid.
• CVE-2026-109619, remote code execution through stale global state. Per PHP, internal state that belongs to one request can survive after its memory has been freed. A later request handled by the same worker may use that stale state before normal setup resets it.

You don’t need to understand memory handling to act on this. What matters is the outcome both advisories describe: a remote, unauthenticated attacker may be able to run code on your web server.

Who is affected

PHP’s advisory says the risk covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team considers the risk highest for Apache with mod_php. It says there is a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. That detail matters, because it means a well-maintained WordPress site or business app is not protected just because its own code and plugins are current. The language runtime underneath has to be patched too.

CISA adds an important warning: PHP is often a component of other software, so you may not see it directly. A vendor appliance, a self-hosted help desk, an intranet wiki, or a customer portal installed years ago may have PHP buried inside it.

Where NYC SMBs usually find PHP

• The company website. WordPress and many other content management systems run on PHP. If your site is on shared or managed hosting, your host controls the PHP version. If it runs on a server or virtual machine you rent, someone on your side probably does.
• Client and vendor portals. Invoice portals, intake forms, document upload pages, and scheduling tools are often PHP apps.
• Online stores. Many e-commerce platforms run on PHP. CISA also added an Adobe Commerce and Magento file-upload flaw, CVE-2026-48356, to the KEV catalog on October 27, so stores built on that platform have two items to check this week.
• Internal tools. Self-hosted help desks, wikis, inventory systems, and older line-of-business apps installed on an office server.
• PHP 8.1 and older. PHP says versions 8.1 and earlier no longer get updates from the project. Some Linux distributions and long-term support vendors backport fixes, and the PHP team provided minimal source backports for 7.4, 8.0, and 8.1. Even so, an old PHP version is now a business risk, not just a technical debt item.

What to do this week

CISA’s alert lays out a clear set of actions. Here they are in plain language, in the order we’d tackle them for a small or midsize business.

1. Find every place PHP runs

Make a list of your websites, portals, stores, and internal web apps. For each one, write down who hosts it and who is responsible for updates. CISA specifically tells organizations to identify and inventory systems running any version of PHP, and to remember that PHP may be hidden inside other products.

2. Patch internet-facing systems first

Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to your Linux distribution’s or vendor’s patched package. PHP says distributions and LTS vendors received the patches in advance, so updated packages should already be available from most of them. Start with anything reachable from the internet, because that is what an unauthenticated attacker can reach.

If your website is on managed hosting, open a ticket with your host today. Ask them to confirm, in writing, the PHP version your site runs on and whether it includes the October 21 fixes. Don’t accept “we patch regularly” as an answer. Ask for the version number.

3. Take unpatchable systems offline

This is the hard one. CISA says organizations that cannot update immediately, or that still run PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated. For a small business, that might mean temporarily pulling an old client portal or a forgotten test site off the internet. It is disruptive, but it is far less disruptive than a compromised server.

4. Use stopgaps only as stopgaps

CISA notes a web application firewall may provide some protection until systems are patched. The PHP advisory also lists configuration changes that reduce exposure to specific attack paths, such as disabling session upload progress and lowering post size limits. PHP is clear that these measures do not make an installation safe and that only an update is a complete solution. Treat them as a bridge for a few days, not a fix. Have whoever manages the server follow the PHP advisory directly rather than a summary.

The PHP team also published an informational advisory on October 23 suggesting session upload progress stay disabled until the next regular bugfix release, to fully close an unlikely related path tracked as CVE-2026-115560. If your administrator applied that setting earlier, PHP says to keep it in place.

5. Watch for signs of compromise

CISA asks defenders to monitor for suspicious activity, including PHP worker processes launching shells or downloading tools, and it published a SIGMA detection rule that security teams can load into their log tools. CISA has also flagged these CVEs for its forensics triage requirements, so systems that were exposed and unpatched deserve a closer look, not just an update. If a server was internet-facing and unpatched for any part of the last week, assume it needs a review.

6. Check Windows PHP builds and the Brotli fix

On October 26, PHP released updated Windows builds (8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1) that include Brotli 1.2.1. That fixes CVE-2026-111497, an out-of-bounds write in Brotli decompression, which CISA added to the KEV catalog on October 27. PHP says the vulnerable code can be reached in Windows builds through the cURL extension when automatic HTTP response decompression is turned on. That setting is off by default in cURL, but applications can enable it. If you run PHP on Windows servers, install the rebuilt packages.

Questions to ask your web host or IT provider

Many NYC businesses don’t manage their own web servers, and that’s fine. What matters is that someone is accountable. Send these questions to your web host, your web developer, or your IT provider today:

• Which of our sites and applications run on PHP, and which PHP version is each one on right now?
• Have those systems been updated to a version that includes the October 21, 2026 PHP security fixes?
• Are any of our systems on PHP 8.1 or older? If so, what is the plan, and should they be offline until it’s done?
• Do we have a web application firewall in front of our public sites?
• Have you reviewed logs on our internet-facing PHP systems for suspicious activity since October 21?
• Who will tell us when the next critical PHP release lands?

If nobody can answer the first question, that is the real finding. You can’t patch what you don’t know you have.

Why this one deserves your attention

Many KEV entries affect a single vendor’s product, like a VPN, a firewall, or a remote support tool. We covered the Plex Media Server KEV chain last week and BeyondTrust Remote Support CVE-2026-102764 the week before. This one is different because it sits inside a building block that countless products share. When a foundational language runtime gets a critical, unauthenticated remote code execution bug, the list of affected systems is long and often unclear.

That is exactly the kind of event where a written asset inventory, a clear owner for every public system, and a patch process with deadlines pay off. Businesses that have those things can answer “are we exposed?” in an hour. Businesses that don’t can spend days just finding out. If you’re not sure what a managed service provider handles in a week like this, our guide to what an MSP does walks through it.

How MicroSky helps when a KEV lands

When CISA adds a new entry to the KEV catalog, MicroSky Managed Services follows the same routine for every client. We check our asset inventory and endpoint data to see who runs the affected software, including components hidden inside other products. We confirm the vendor’s fixed version and apply it or verify it with the responsible host. We check exposed systems for the warning signs the vendor and CISA published. Then we close unneeded exposure and document what we found and what we changed.

If you aren’t sure which PHP version your website, portal, or store runs on, or who is responsible for patching it, we can help you find out this week. Call MicroSky at (718) 672-2177 or visit microskyms.com to talk with our team.

Sources: PHP, “Security advisory: Critical remote code execution vulnerabilities, update now” (October 21, 2026), plus PHP’s October 20 advance notice, October 23 informational advisory, and October 26 Windows builds notice on php.net; CISA, “Critical Vulnerabilities in PHP Require Immediate Patching” (last revised October 26, 2026); CISA Known Exploited Vulnerabilities catalog (entries added October 26 and 27, 2026); NIST NVD entries for CVE-2026-109618 and CVE-2026-109619. Research compiled by MicroSky as an in-house SA-research pack.