{"resourceId":"cisa-php2shell-alert-kev-2026","versions":[{"version":"external-d893fcfbc32769abd54dcee8d71d1acd375113551006db25d13c282d8efec19a","resource":{"id":"cisa-php2shell-alert-kev-2026","title":"Critical Vulnerabilities in PHP Require Immediate Patching","organization":"Cybersecurity and Infrastructure Security Agency (CISA)","sector":"Federal cyber agency guidance applicable to SLTT","geography":"United States","publishedAt":"2026-10-21 (last revised 2026-10-26)","publicationDate":"2026-10-21","eventDate":"2026-10-26","sourceName":"CISA","sourceLabel":"CISA cybersecurity alert","sourceUrl":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","evidenceClass":"standards-guidance","outcomeClass":"cautionary","topics":["infrastructure","data-security","governance-procurement"],"finding":"CISA's alert, last revised Oct 26, 2026, says the php2shell flaws allow unauthenticated remote code execution across PHP installations serving web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on Oct 26 and urges inventorying all PHP (including embedded instances that may not be directly observable), patching internet-facing systems first to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, taking unpatchable or PHP 8.1-and-earlier systems offline, and monitoring for PHP workers launching shells. An Oct 23 update added a SIGMA detection rule.","sledRelevance":"CISA's guidance is the reference point for state, local, tribal and territorial patch priorities. The KEV listing on Oct 26 contrasts with CrowdStrike's Oct 23 assessment that no successful exploitation had been observed, which matters for SLED teams weighing vendor intelligence against federal designations.","evidence":"Official federal alert with update history. KEV listing indicates CISA has evidence of exploitation, but the alert does not describe victims or volumes.","architectureImplications":"Embedded PHP inside other products means inventory must extend to appliances and vendor software, not just self-managed web servers.","governanceImplications":"KEV listing triggers federal remediation duties; SLTT entities often adopt KEV as a prioritization benchmark. CISA does not endorse any commercial product.","securityPrivacyImplications":"RCE on public-facing web servers can expose resident data and credentials; WAFs give partial protection only until patching.","caveats":"Federal guidance; it does not state SLED-specific exploitation. Not CrowdStrike-specific; included because it contradicts and updates CrowdStrike's Oct 23 exploitation assessment. Why now: Oct 26 KEV revision postdates the vendor view.","streamIds":["crowdstrike"],"roles":{"sales":"Federal designation is the framing point: CISA's Oct 26 KEV listing turns PHP2Shell into a known-exploited issue that SLED leaders will benchmark against. The bounded conversation is about whether the customer can show an inventory and patch record that meets that bar. Interpretation: support with inventory and detection validation, citing CISA rather than vendor messaging. CISA explicitly endorses no commercial product, so do not present the alert as backing CrowdStrike or any other tool.","engineering":"Embedded PHP is the framing point: CISA warns PHP is often inside other software and may not be directly observable. Interpretation: pre-sales should help the customer identify PHP in appliances, vendor applications and containers, then verify patched versions and test CISA's SIGMA rule against their logs. Monitoring for PHP worker processes launching shells is a concrete check that most EDR and SIEM tools can perform, so the validation does not depend on a single platform.","delivery":"Remediation sequencing is the framing point: CISA orders internet-facing systems first and offline status for systems that cannot be patched. Interpretation: delivery should maintain a remediation tracker, record exceptions with owner sign-off, and deploy the SIGMA rule. Ownership sits with the CIO's infrastructure team and the SOC. Proposed acceptance criteria include every internet-facing PHP system patched or offline and the detection rule deployed and tested; this source reports no outcome measurements."},"roleDetails":{"sales":{"customerProblem":"A known-exploited, unauthenticated RCE affects PHP across public-facing SLED web estates, including embedded instances.","stakeholders":["CIO","CISO","Web and application owners","Procurement for hosted services"],"discoveryQuestions":["Can you list every PHP instance, including embedded and hosted?","Which systems run PHP 8.1 or earlier?","Is CISA's SIGMA rule deployed?"],"valueHypothesis":"Structured inventory and detection reduce time exposed after a KEV listing; not quantified.","potentialEngagement":"KEV-aligned remediation tracking and detection deployment support.","unsupportedClaims":["CISA endorsement of a vendor","Confirmed SLED compromises","That a WAF fully mitigates"]},"engineering":{"fit":"Universal for SLED entities running PHP directly or via vendors.","architectureIntegration":"SIGMA rule into SIEM; EDR for shell-spawn detection on web hosts.","prerequisites":["Software inventory covering embedded components","Log sources for web servers","Patch management access"],"constraints":["Vendor-controlled patch timing","Legacy PHP branches","Containerized images needing rebuild"],"security":"Patch first; treat WAF rules as temporary.","proofOfValue":["Deploy and test SIGMA rule","Confirm fixed versions on internet-facing hosts","Alert test for worker-spawned shells"]},"delivery":{"work":"Remediation tracker, exception handling, detection deployment.","dependencies":["Vendor patch releases","Change approvals","SIEM engineering time"],"ownership":"Infrastructure team with the SOC.","skillsAdoption":"Teams need to verify backported patches and maintain SIGMA content.","governanceCheckpoints":["KEV-based deadline","Exception sign-off","Closure review"],"acceptanceCriteria":["Proposed: internet-facing PHP patched or offline","Proposed: SIGMA rule deployed and tested","Proposed: exceptions documented with owners"],"risks":["Unknown embedded PHP","Service outages from offline decisions","Detection gaps on hosted sites"]}},"retrievedAt":"2026-10-30T22:11:42-05:00","enrichedAt":"2026-10-30T22:21:24-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Taking systems offline can cut resident access to services; alternatives are not addressed by CISA.","procurementImplications":"Hosted and embedded PHP depends on vendors' patch schedules, supporting contract patch commitments.","operatingModelImplications":"KEV listings act as de facto deadlines for SLTT patch programs.","sourceVerification":{"openedUrl":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","referenceExcerpt":"CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV Catalog on Oct. 26, 2026.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}