# Federal Agencies Urge PHP2Shell Patching

On October 21–22, 2026, NSA, FBI, and CISA urged organizations to remediate two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after the PHP project released emergency fixes. The flaws could permit unauthenticated remote code execution on affected servers. Reports described millions of attempted exploitations and active reconnaissance, although an October 23 alert revision reported no exploitation observed at that time. Agencies advised taking systems offline if they cannot be secured promptly; CISA’s stated timeframe for serious mitigations was no more than three days. No solicitation, award, or dedicated funding is identified.

- Federal IT contractors may be called on to inventory PHP runtimes—including those embedded in third-party products or hosted services—prioritize internet-facing systems, apply fixes, and verify remediation.
- Organizations should test older applications for upgrade compatibility and coordinate patching with hosting providers; systems that cannot be mitigated promptly should be isolated or taken offline, consistent with the advisories.
- The alerts indicate near-term demand for vulnerability assessment, patch deployment, logging, and incident-response support, but do not establish a specific procurement opportunity or mandatory contract requirement.

**Jurisdictions:** federal, international
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Digital Infrastructure
**Published:** October 25, 2026

### Government Entities
- National Security Agency (NSA)
- Federal Bureau of Investigation (FBI)
- Cybersecurity and Infrastructure Security Agency (CISA)

### Key Quotes
> The gap between disclosure and widespread, repeatable exploitation is typically hours to a few days for vulnerabilities of this severity and attack ROI.
> — Kelly Shortridge, Chief Product Officer at Fastly

### Sources
- [
	NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities > National Security Agency/Central Security Service > Press Release View
](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) - NSA
- [
	NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities > National Security Agency/Central Security Service > Press Release View
](https://www.nsa.gov/press-room/press-releases-statements/press-release-view/article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) - NSA
- [AI exposes critical PHP flaw, governments race to shut sites and patch - CHOSUNBIZ](https://biz.chosun.com/en/en-it/2026/10/22/MDFMNLLLCND6XOUPWELNZ4S3PY) - Chosunbiz