---
title: New York DFS tells regulated banks and insurers to patch PHP2Shell now, or take unpatched systems offline | ctxsec
url: https://ctxsec.com/items/nydfs-industry-letter-php2shell-oct-22
description: ""
status: "confirmed (NY DFS industry letter, Oct 22)"
published: 2026-10-22
---

> 

[← Industry News](/industry) · [markdown](/items/nydfs-industry-letter-php2shell-oct-22.md)

confirmed (NY DFS industry letter, Oct 22)

2026-10-22

### New York DFS tells regulated banks and insurers to patch PHP2Shell now, or take unpatched systems offline

The New York State Department of Financial Services issued an industry letter on **Oct 22** about CVE-2026-109618 and CVE-2026-109619. It tells regulated entities to find every PHP use (including internet-facing apps and third-party providers), patch immediately with internet-facing systems first, take systems that can't be patched **offline** until secured, and review logs for PHP processes launching shells, running commands or downloading tools. DFS says a WAF may give limited protection but is **not a substitute** for patching or isolation, and ties each step to its 2026 Heightened Cybersecurity Threat Environment Guidance.

Sources: [NY DFS: Cybersecurity Alert, Critical Vulnerabilities in PHP that Require Immediate Patching (Oct 22)](https://www.dfs.ny.gov/industry_guidance/industry_letters/il20261022-cyber-php-patching)