NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities

FORT MEADE, Md. - PHP - short for PHP: Hypertext Preprocessor - works on most major operating systems. It runs directly on web servers and can be added into HTML to create dynamic web pages. Because PHP is so widely used, these security flaws can create an environment ripe for exploitation.

We are prioritizing identification of malicious cyber actors that may seek to exploit these vulnerabilities, collectively nicknamed "PHP2Shell," and recommend organizations take the following precautions.

What Should be Done?
It will be critical in the coming weeks to maintain heightened awareness of your internet-facing devices and services that are reliant on PHP. It is essential for all to prioritize incorporating vendor patches that may be explicitly tied to the PHP2Shell issues. All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions. Vigilance in applying patches related to those systems is paramount.

PHP released their open-source software patch Wednesday, October 21, 2026. Additional software vendors may also publish patches once they are available. It's imperative to closely monitor these updates.

Information on the latest mitigations and patching guidance is available on the PHP.net Security Advisory page.

While vendors work to patch their individual software packages, it is important for organizations to assess whether additional mitigation steps should be taken such as:

• Adding enhanced logging within network/operational environments

• Replacing end-of-life PHP services which will not be compatible with patching

• If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.

Why is this an Issue?
"PHP2Shell" could allow attackers to take control of affected web servers without prior access or authentication. Such an access vector could help attackers steal sensitive data, disrupt services, or move deeper into a network. These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration. Servers running affected PHP versions are exploitable.

Cyber actors are likely to weaponize PHP2Shell vulnerabilities. These risks are serious enough to require immediate patching across United States Government departments and agencies.

The Way Forward
NSA will continue to work with experts across the intelligence community (IC), including CISA, to identify and address potential U.S. Government and National Security Service vulnerabilities. We stand with our warfighters and our domestic and foreign partners to improve our collective cyber defenses and threat detection.

NSA Media Relations
[email protected]
443-634-0721

About the National Security Agency

The National Security Agency leads the U.S. Government in cryptology that encompasses both foreign signals intelligence (SIGINT) insights and cybersecurity products and services and provides the Nation decision advantage in competition, crisis, and conflict.

###