Key point: The NSA and CISA have urged immediate patches for two critical PHP vulnerabilities. Here are six questions to guide your discussion with IT.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” can permit unauthenticated remote code execution on affected systems. Exploitation attempts were reported even before the patch was released, and the NSA and CISA are urging organizations to identify systems using PHP and patch them immediately, prioritizing internet-facing systems.
The potential consequences are significant. An attacker could install malware or ransomware, access sensitive data, alter a website, create backdoor access or use a compromised server to reach other systems on an organization’s network. PHP can also be embedded in third-party software, meaning organizations may not immediately know everywhere it is running.
Business leaders and in-house counsel do not need to master the technical details. Instead, they should ask the right questions, identify obstacles to remediation and make sure the people responsible have the resources to act.
Ask your IT and cybersecurity teams:
- Do we have PHP in our environment, and do we know where it is?
- Have we identified and prioritized our internet-facing PHP systems?
- Have affected systems been patched?
- If we cannot patch immediately, what are we doing with the affected systems?
- Are we looking for signs that someone may already have exploited these vulnerabilities?
- What resources or decisions does IT need from the company today to materially reduce our risk?
If potentially malicious activity is identified, organizations should consider promptly involving legal counsel and their incident-response team to help investigate, preserve relevant evidence and evaluate potential contractual, regulatory or notification obligations. For more on PHP2Shell, including affected versions, patching guidance, and additional considerations for organizations responding to the vulnerabilities, read our full alert.
The Bottom Line
Business leaders do not need to become PHP experts. They should know where PHP is running, whether affected systems have been patched and what IT needs from leadership to move faster. Critical vulnerabilities are not solely an IT issue. Cybersecurity is a key element of business risk, and senior management has an important role in removing obstacles between identifying a new risk and controlling it.