CISA confirms active exploitation of two PHP2Shell RCE flaws
Original title: CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Both flaws score CVSS 9.2; fixes shipped October 21, and US agencies must patch by October 29.
CISA added CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 unauthenticated remote code execution bugs called PHP2Shell, to its Known Exploited Vulnerabilities catalog. Adel Karimi of Perplexity reported successful RCE against honeypots on October 24, including an 800 KiB cookie dump using a public exploit on single-worker mod_php. PHP fixed the issues in 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. Windows builds released October 26 also address CVE-2026-111497 in the Brotli decoder.
Unconfirmed: Karimi's evidence is limited to single-worker mod_php honeypots; exploit reliability elsewhere and in-the-wild use of CVE-2026-111497 are not established.
- CVE-2026-109618 is an out-of-memory corruption bug enabling unauthenticated remote code execution.
- CVE-2026-109619 is a stale internal request-state bug enabling unauthenticated remote code execution.
- Censys estimates more than 32.51 million PHP services still run an affected version.
- Brotli 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 are fixed in 1.0.10, 1.1.1, and 1.2.1.
- On PHP for Windows, the Brotli decoder is reachable when cURL decompression is enabled.
Impact: Unauthenticated remote code execution on affected PHP deployments
| Product | Affected | Fixed in |
|---|---|---|
| PHP Foundation PHP | — | 8.5.12, 8.4.27, 8.3.36, and 8.2.35 |
| PHP Foundation PHP Windows builds | — | 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 |
| Brotli | 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 | 1.0.10, 1.1.1, and 1.2.1 |
- 1.Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- 2.Install PHP Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, or 8.2.35-1.
- 3.Update Brotli to 1.0.10, 1.1.1, or 1.2.1.
- Vendors
- PHP Foundation
- Organizations
- CISAPerplexityCensys
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.