NACSA Urges Immediate Patching of Internet-Facing PHP Systems

Malaysia's National Cyber Security Agency (NACSA), through NC4, urged organizations running internet-facing PHP applications to immediately install updates for two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Emergency patches released on 21 October 2026 cover PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while MyCERT recommends taking unpatched systems offline.

• PHP2Shell flaws tracked as CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE
• Patched releases: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, issued 21 October 2026
• PHP 8.1 and older no longer receive security updates from the PHP project
• MyCERT advises temporarily taking unpatched internet-facing systems offline