For the past two weeks, officials from the NSA’s Central Security Service and the Cybersecurity and Infrastructure Security Agency have been warning those using most major operating systems about a new hacking crisis.
Organizations are being told to immediately patch the recently disclosed vulnerabilities in PHP (short for “PHP: Hypertext Preprocessor”) that are now known as “php2shell.” The vulnerability allows for unauthorized remote code execution in PHP that can be added into HTML to create dynamic web pages.
While CISA has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication, they pose a risk to organizations if left unpatched.
“We are prioritizing identification of malicious cyber actors that may seek to exploit these vulnerabilities, and recommend organizations take the following precautions,” the NSA said in its advisory.
What should be done?
The NSA said it will be critical in the coming weeks to maintain heightened awareness of Internet-facing devices and services that are reliant on PHP. It is essential for all to prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues. All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions. Vigilance in applying patches related to those systems is paramount.
PHP released its open-source software patch on Oct. 21. Additional software vendors may also publish patches once they are available. It’s imperative to closely monitor these updates.
Information on the latest mitigations and patching guidance is available on the PHP.net Security Advisory page at https://www.php.net/index.php#2026-10-21-5.
While vendors work to patch their individual software packages, it is important for organizations to assess whether additional mitigation steps should be taken, such as:
• Adding enhanced logging within network/operational environments.
• Replacing end-of-life PHP services that will not be compatible with patching.
• If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.
Why is this an issue?
“PHP2Shell” could allow attackers to take control of affected web servers without prior access or authentication. Such an access vector could help attackers steal sensitive data, disrupt services, or move deeper into a network. These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration. Servers running affected PHP versions are exploitable.
Cyber actors are likely to weaponize PHP2Shell vulnerabilities. These risks are serious enough to require immediate patching across United States government departments and agencies.
The way forward/actions to take
NSA will continue to work with experts across the intelligence community (IC), including CISA, to identify and address potential U.S. government and national security system vulnerabilities. Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
• A web application firewall may provide some protection until systems are updated or patched.
• Review the official PHP security advisory for guidance on patching.
• Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.