CISA says PHP2Shell flaws are exploited for remote code execution
Original title: CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks
Federal civilian agencies must mitigate CVE-2026-109618 and CVE-2026-109619 or remove affected products by October 29.
CISA added two critical PHP flaws, jointly called PHP2Shell, to the Known Exploited Vulnerabilities catalog on October 26 after confirming real-world exploitation. CVE-2026-109618 is a memory-corruption issue after an out-of-memory condition, and CVE-2026-109619 leaves stale internal request state. Either can give an unauthenticated attacker remote code execution as the PHP web worker. PHP fixed supported branches in 8.2.35, 8.3.36, 8.4.27, and 8.5.12; branches 5.x, 7.x, 8.0, and 8.1 are no longer maintained by the PHP project.
- Binding Operational Directive 26-04 sets a October 29 federal mitigation deadline.
- Internet-facing PHP servers should be patched and restarted so the new runtime loads.
- Vendor-packaged PHP in panels, containers, and cloud images may need a separate update.
- Web application firewalls may block some requests but do not replace upgrading PHP.
Impact: Unauthenticated remote code execution as the PHP worker
| Product | Affected | Fixed in |
|---|---|---|
| PHP | Older supported branches; 5.x, 7.x, 8.0, and 8.1 are unmaintained | 8.2.35, 8.3.36, 8.4.27, and 8.5.12 |
- 1.Upgrade supported PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart it.
- 2.Identify internet-facing servers and separately update products that bundle their own PHP runtime.
- 3.Review application, web, PHP-FPM, process, and outbound-connection logs for compromise before patching.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency has added two critical PHP vulnerabilities, jointly known as PHP2Shell, to its Known Exploited Vulnerabilities catalog after confirming real-world exploitation.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.