CISA adds exploited PHP2Shell flaws to its KEV catalog
Original title: U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
Unauthenticated HTTP requests can run code on PHP engines dating to PHP 5.4; agencies must fix by October 29, 2026.
CISA added two critical PHP flaws, collectively called PHP2Shell, to the Known Exploited Vulnerabilities catalog after emergency patches on October 21. CVE-2026-109618 is a memory-corruption bug and CVE-2026-109619 a stale internal request-state bug, both scored 9.2, in the PHP engine rather than individual applications. Unauthenticated attackers can execute code with crafted HTTP requests. Cloudflare reported exploit attempts rising from tens of thousands in 45 minutes to millions by October 22. Federal civilian agencies must remediate by October 29, 2026.
Unconfirmed: Cyfirma attributes scanning of 216 hosts to an unnamed North Korea-linked group; CISA does not name that group.
- Both flaws carry a CVSS score of 9.2.
- Vulnerable engine code dates to PHP 5.4, released in 2012.
- Cloudflare reported millions of attempts by October 22.
- Cyfirma says operators listed 216 unpatched or partly mitigated hosts.
- Those operators used 21 scan nodes and web-shell tooling.
Impact: Unauthenticated remote code execution via crafted HTTP requests
| Product | Affected |
|---|---|
| PHP | All versions that handle web requests; engine code since PHP 5.4 |
- 1.Apply the October 21 PHP emergency patches.
- 2.Federal civilian agencies must remediate by October 29, 2026.
- 3.Review hosts for web-shell tooling and upload-progress session poisoning.
- Vendors
- PHP
- Organizations
- CISACloudflareCyfirma
- Countries
- United StatesNorth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.