The National Security Agency is urging organizations to address a set of critical PHP vulnerabilities known as PHP2Shell. The vulnerabilities could allow attackers to take control of affected web servers without an existing login or prior access.
Organizations should determine whether they use affected PHP versions, prioritize available patches and monitor technology vendors for additional updates.
What is PHP?
PHP is a programming language used to create dynamic websites and web-based services. It runs on web servers and can generate content that changes based on user activity, data or other inputs.
PHP works across most major operating systems and is widely used. A vulnerability in PHP can therefore affect many organizations and technology providers.
What happened?
Security flaws have been identified in PHP and collectively nicknamed PHP2Shell. According to the NSA, the vulnerabilities could allow attackers to take control of affected web servers without prior access or authentication.
The flaws exist within PHP rather than within the hosted application or its configuration. Servers running affected PHP versions are exploitable. PHP released an open-source software patch on October 21, 2026.
Why do the PHP2Shell vulnerabilities matter?
An attacker who successfully exploits an affected server could:
- Steal sensitive data
- Disrupt websites, applications or other services
- Use the affected server to move deeper into a network
The NSA expects cyber actors to attempt to weaponize the vulnerabilities. The risk prompted an immediate patching requirement across U.S. government departments and agencies.
One 2026 analysis estimated that the median time between the disclosure of a Common Vulnerabilities and Exposures (CVE) security flaw and the appearance of a working exploit had fallen to approximately 10 hours.
“While there is currently no known exploit for this vulnerability, the widespread use of PHP makes it an attractive target for threat actors.” says Matt Thomson, Director of Cyber Liability at M3. “Organizations should be on heightened alert, address vulnerable systems quickly and be prepared to execute their incident response plans.”
What should organizations do?
The NSA recommends maintaining heightened awareness of internet-facing devices and services that depend on PHP. Organizations should coordinate with internal IT and security teams, managed service providers and relevant technology vendors to determine whether affected systems are present.
1. Take inventory
Identify hardware and software services that rely on vulnerable PHP versions where feasible. Include internet-facing systems and services managed by third-party vendors.
2. Prioritize applicable vendor patches
Apply vendor patches that are explicitly connected to the PHP2Shell vulnerabilities. Follow the vendor’s instructions and account for any testing or operational requirements before deployment.
3. Apply the PHP security patch
PHP released an open-source patch on October 21, 2026. Other software vendors may release related patches for products that rely on PHP, so organizations should continue monitoring vendor communications.
4. Follow current security guidance
Review the PHP Security Advisory page and applicable vendor guidance for current patching and mitigation information.
Additional steps while vendors prepare patches
When a patch is unavailable or cannot be applied immediately, the NSA recommends evaluating additional safeguards:
- Add enhanced logging within network and operational environments.
- Replace end-of-life PHP services that are no longer supported or cannot accept the necessary patch.
- Take affected systems offline until they can be fully mitigated when an immediate update is not feasible.
Where to start
Business leaders do not need to diagnose the vulnerability themselves. They can help establish clear ownership and make sure the issue receives an appropriate response.
Consider asking:
- Do we use affected PHP versions?
- Which websites, applications or services are affected?
- Do any vendors manage affected systems for us?
- Are applicable patches available?
- Who is responsible for testing and applying each patch?
- If a patch cannot be applied immediately, what safeguards are in place?
- Are any affected PHP services at the end of their supported life?
What happens next?
Additional software vendors may publish patches for products that depend on PHP. Organizations should continue monitoring vendor notifications and current PHP security guidance.
The NSA has also stated that the agency will continue working with intelligence community experts, including CISA, to identify and address potential vulnerabilities and support broader cyber defense and threat-detection efforts.
Fast-moving vulnerabilities can reveal gaps in software inventories, patching practices and vendor oversight. Organizations with clear system ownership and an established process for reviewing critical security updates are better positioned to coordinate a response.
Patching and technical remediation should be handled by an organization’s IT team, security team, technology provider or cybersecurity vendor.
The M3 Cyber Liability team can answer questions about the broader risk implications of the advisory and help connect clients and prospects with trusted IT and security vendor partners that can assist with patching and mitigation.
Questions about how PHP2Shell may affect your organization’s broader cyber-risk strategy? Connect with the M3 Cyber Liability team.
Looking for More Cyber Insights?
Cybersecurity is an ongoing effort that requires a combination of prevention, preparedness, and risk management. Whether you’re evaluating security controls, strengthening incident response procedures, or reviewing cyber liability coverage, M3’s cyber resources can help you stay informed and make more confident decisions.
