CISA urgently recommends organizations patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These "php2shell" vulnerabilities enable unauthenticated remote code execution, impacting all PHP installations serving web requests. Immediate updates to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 are necessary. Although CISA hasn't observed active exploitation, the risk is significant if left unpatched. Organizations must identify and inventory all PHP systems, as PHP is often an embedded component. Prioritize patching internet-facing systems immediately. If immediate patching is not possible, especially for unsupported PHP 8.1 or earlier versions, take PHP-based systems offline. A web application firewall can offer temporary protection. Review the official PHP security advisory for detailed patching guidance. Continuously monitor for suspicious activities like PHP worker processes launching shells.