---
title: FBI follows up on PHP2Shell with a formal PSA: patch now, or take unpatchable systems offline | ctxsec
url: https://ctxsec.com/items/fbi-ic3-psa-php2shell-oct-23
description: ""
status: "confirmed (FBI IC3 PSA, Oct 23)"
published: 2026-10-23
---

> 

[← Industry News](/industry) · [markdown](/items/fbi-ic3-psa-php2shell-oct-23.md)

confirmed (FBI IC3 PSA, Oct 23)

2026-10-23

### FBI follows up on PHP2Shell with a formal PSA: patch now, or take unpatchable systems offline

The FBI published IC3 PSA **261023**, a follow-up to its Oct 21 social media warning on the PHP core RCEs **CVE-2026-109618** and **CVE-2026-109619**. It urges organizations to update immediately per php.net, inventory where PHP runs (including vendor products that bundle it), and, unusually, to **take systems offline** if they cannot be updated right away. It also asks defenders to watch for PHP processes launching shells or downloading files, and to report compromises to a local FBI field office or ic3.gov with web server and PHP logs preserved.

Sources: [FBI IC3 PSA: Critical Vulnerability Alert: PHP Core (Oct 23)](https://www.ic3.gov/PSA/2026/PSA261023) · [CISA alert (Oct 21)](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)