CISA and Unit 42 Issue Urgent Patch Directive for Critical PHP2Shell Remote Code Execution Flaws

The U.S. Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and threat intelligence researchers at Palo Alto Networks Unit 42 issued an urgent joint remediation directive on Wednesday warning enterprise cloud operators across San Francisco, San Jose, and the broader Silicon Valley corridor to patch two critical remote code execution vulnerabilities in the PHP runtime. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed "PHP2Shell," the flaws carry a 9.2 severity rating and allow unauthenticated attackers to execute arbitrary shell commands on exposed web servers.

Core maintainers from the PHP development group released emergency security builds—versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35—after telemetry confirmed automated scanning across more than twenty-two million internet-facing instances worldwide. Several hundred commercial web portals temporarily took applications offline on Wednesday morning to apply runtime upgrades and rotate FastCGI process credentials before automated botnets could deploy persistent web shells.

Unit 42 security analysts noted that the vulnerability chain originated in edge-case input parsing routines that were recently surfaced during automated large-language-model static code audits. In a separate bulletin issued Wednesday afternoon, CISA also warned systems administrators to patch four actively exploited vulnerabilities in Plex Media Server—tracked as "Plex2Shell"—and highlighted a new $10 million grant program by Accenture, Dragos, and the SANS Institute providing pro-bono defense monitoring to five hundred municipal water districts and electric utilities.

San Francisco and East Bay DevOps teams and municipal information technology department leaders are advised to upgrade containerized PHP workloads immediately, enforce strict web-application firewall rules blocking malformed query encodings, and audit outbound server connections. Complete technical indicators of compromise and YARA detection signatures are available through the official CISA advisory portal at cisa.gov/known-exploited-vulnerabilities.