CISA’s PHP Alert: What Business Owners Should Ask IT to Check

If your business relies on software using PHP, CISA’s October 21, 2026 alert calls for a decision now: update affected systems or take them offline until they can be fixed. CISA describes PHP as software that handles web requests and can also be a component of other software. Ask your IT provider to check your systems rather than assume this alert only concerns your website.

What does CISA say is affected?

CISA says the vulnerabilities affect all PHP installations serving web requests. In its alert on critical PHP vulnerabilities, CISA identifies the flaws as CVE-2026-109618 and CVE-2026-109619, collectively known as “php2shell.” Use those identifiers when asking your provider for a status report.

CISA says the flaws allow unauthenticated remote code execution, meaning an attacker can run code remotely without first signing in. CISA reported no observed exploitation as of the alert’s publication, but explicitly warned that unpatched systems remain at risk. Treat that statement as a dated observation, not a reason to delay the review.

Which PHP versions does CISA recommend?

CISA directs organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to fix these vulnerabilities. A patch is a software update that fixes a flaw; CISA’s instruction here is to apply the fixes immediately, prioritizing internet-facing systems, meaning systems reachable from the internet.

CISA also urges organizations to review the official PHP security advisory for patching guidance. Ask your IT provider to use that guidance and report the installed version for each affected system, rather than simply marking the alert as reviewed.

What if a system cannot be updated immediately?

CISA says organizations unable to update immediately should take PHP-based systems offline until they can be patched or updated. CISA gives the same direction for organizations still using PHP 8.1 or earlier unsupported versions. Ask your operations lead and IT provider to identify which business activities would need to pause if that instruction applies.

CISA says a web application firewall—a tool that filters requests to a web application—may provide some protection until updates are complete. CISA still directs organizations that cannot update immediately to take PHP-based systems offline. Do not treat a firewall as confirmation that the required update is complete.

Where is PHP likely running in your business?

PHP is one of the most widely used languages on the web, so it usually sits underneath software you know by brand name rather than by programming language. Common examples include:

• Website platforms: WordPress, Drupal and Joomla, along with the plugins and themes built on them.
• Online stores: WooCommerce, Magento (Adobe Commerce) and PrestaShop.
• File sharing and collaboration: Nextcloud.
• Training and knowledge bases: Moodle and MediaWiki.
• CRM and marketing: SuiteCRM and Mautic.
• Admin and hosting tools: phpMyAdmin and many web hosting control panels.
• Custom applications: customer portals, intake forms and internal tools built on frameworks such as Laravel or Symfony.

Hosting changes who applies the update, not whether it needs to happen. If a vendor or hosting company runs the software for you, ask them to confirm in writing that their PHP is on one of the fixed versions. If you or your IT provider host it, the update is yours to schedule.

Start with a system list, not an assumption

CISA recommends identifying and inventorying systems running any PHP version across the organization, noting that PHP’s presence inside other software may not be directly observable. CISA also recommends monitoring for suspicious activity, including PHP processes launching command tools or downloading tools.

Send your IT provider one request today: list every affected system, its PHP version, its update status, and whether it must go offline under CISA’s guidance. Ask for a named person responsible for each unresolved item and a time for the next status report.

How this post was made. Brian M. McCarthy shared a link in one of our Teams channels. From there the article, its headline and its header image were generated by AI, and then read and approved by a person at Open Tier Systems before any of it was published — nothing reaches this blog unread. We work this way on purpose: it is the same kind of automation we build for our Clients, and showing you what it can do beats describing it.