Agency security brief · October 22, 2026

PHP2Shell: four questions to send your website provider today.

You don’t need to write code to ask whether an urgent security fix is running. You do need someone responsible for the answer.

Cirlet · Primary sources checked October 22, 2026

What happened

On October 21, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says the flaws can allow unauthenticated remote code execution in installations serving web requests. CISA issued an urgent patch alert the same day. The issues are being called PHP2Shell.

That is a software advisory, not evidence that your agency has been compromised. In its October 21 notice, CISA said it had not observed exploitation at the time of publication. The practical response is to establish exposure and confirm the appropriate fix.

Why an insurance agency should care

Your public website, an older portal or another application may use PHP behind the scenes. A provider running the system for you still needs to manage the update. The agency’s job is to identify the responsible provider and get a clear answer, rather than assume that a working website is a patched website.

Whether an individual system is affected depends on its actual software and configuration. A reassuring homepage, a WordPress plugin update or an AI-generated answer is not enough evidence of the underlying PHP runtime.

Send these four questions

Do any systems you operate for us use PHP? Include the website and any related portals or applications. Ask who maintains each system.
Have you addressed both CVEs? Ask for the running version or the distribution’s security-fix reference, not just a general statement that updates are enabled.
How did you verify the fix is active? Ask for the affected system, the time checked and confirmation that the updated software is actually serving requests.
Who owns anything still unresolved? Ask for the next action and its target time, including temporary protection if an immediate update is not possible.

The PHP project lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. Some operating-system vendors provide backported fixes; your provider should identify the relevant advisory for its package. Version text alone can therefore be misleading.

PHP warns that interim mitigations are incomplete. Follow the maintainers’ and your provider’s current guidance. Have the authorized operator plan and verify the update; this article is not a set of production-server configuration instructions.

Get the one-page provider-check worksheet

What this says about AI and security

OpenAI reports that Calif used GPT-5.6 Sol to identify a critical PHP flaw, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes. That is an example of AI-assisted defensive research, not a Cirlet result or proof of access to that model.

For an agency, AI can help turn a long advisory and approved technical evidence into questions, priorities and a fix plan. A capable person still has to confirm the affected systems, authorize the change and verify the result. Faster analysis is useful when it leads to a completed action.

Make the next alert easier to handle

Keep a short record of your public systems, their providers and who can authorize a change. Record the evidence of each fix and what remains open. Apply the same discipline to email accounts and AI tools that can read or act on agency information.

Want help checking your agency?

The Agency AI Security Sprint is a $750 engagement covering one website, one email environment and up to two AI workflows. You get evidence-backed priorities, a written action pack and one agreed improvement. The first conversation with Tyler is free.

Ask Tyler about the sprint

Primary sources

This is general operational guidance, not a finding about your systems, an incident investigation or an insurance coverage opinion. Check the linked advisories for updates.