CISA Alert Urges Organizations to Patch the PHP Remote-Code-Execution Flaws Immediately, or Take Unpatched Systems Offline

On October 21, 2026, CISA published an alert on the PHP flaws it calls “php2shell”. It said they “allow for unauthenticated remote code execution in PHP.” It tells organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and says those that cannot do so at once “should take PHP-based systems offline until they can be patched or updated.” The alert is addressed to organizations in general. It does not name state and local governments or election offices. The original version said “CISA has not observed exploitation of these vulnerabilities as of the time of publication.” An October 23, 2026 revision added “a SIGMA detection rule.” The sentence about no observed exploitation is gone from the version revised on Oct. 26, 2026, the day the flaws were added to the KEV catalog (2026-10-26–cisa-adds-php2shell-cves-to-kev-binding-federal-civilian-agencies-only-due-oct-29).

The PHP Foundation says the release was moved up to “October 21st, 14:00 UTC” after the CVE IDs leaked the day before. The PHP advisory says “Linux distributions and LTS vendors received the patches in advance.”

The channel for state and local offices, including election offices, is the Center for Internet Security’s MS-ISAC, which issued advisory 2026-119 on the same flaws. Its listed issue date is 10/19/2026. CIS says the MS-ISAC moved to “a member-funded model in 2025,” after CISA said that the work it funded under its agreement with CIS “no longer effectuates department priorities.” CIS says EI-ISAC membership for election offices “is included when you join the Multi-State Information Sharing and Analysis Center (MS-ISAC).” Compare 2026-10-19–propublica-dhs-appointees-asked-cisa-to-secretly-acquire-and-hack-voting-machine and 2026-09-22–hegseth-memo-orders-cybercom-defense-intelligence-enterprise-counter-foreign-election-threats.