CISA urges immediate patching of CVE-2026-109618 and CVE-2026-109619 (“php2shell”) enabling unauthenticated RCE in web-serving PHP (mod_php highest risk, also PHP-FPM, php-cgi, FrankenPHP, LiteSpeed). Fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Organizations on PHP 8.1 or earlier should patch via vendor backports or take systems offline. October 23 update added SIGMA detection guidance and partner resources.