CISA confirms active exploitation of PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
Original title: PHP2Shell will persist in enterprise environments for years
Official fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while many appliance and EOL runtimes have no direct patch.
CISA added CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Researchers had already reported widespread scanning and attempted exploitation, without confirmed production compromises. Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but Linux distributions, containers and embedded products often ship their own builds. VulnCheck said 42% of 2.6 million scanned internet-facing PHP hosts ran end-of-life branches.
Unconfirmed: Earlier research reported scanning and exploitation attempts but no confirmed compromise of production systems.
- PHP published minimal source backports for end-of-life 7.4, 8.0 and 8.1.
- PHP 7.3 and older received no upstream coverage.
- VulnCheck found 27% of scanned hosts on PHP 3.x through 7.3.
- Ubuntu, Debian, AlmaLinux, Red Hat, SUSE, Alpine and Amazon Linux set different fix boundaries.
- Flare reviewed 2,220,231 PHP service records across 224 countries.
Impact: Critical PHP flaws under active exploitation; compromise details not stated
| Product | Affected | Fixed in |
|---|---|---|
| PHP | Branches before the stated fixes; 7.4, 8.0, 8.1 and older still widely used | 8.5.12, 8.4.27, 8.3.36, and 8.2.35 |
- 1.Install the stated PHP fixes or the matching distribution backport.
- 2.Inventory bundled PHP in appliances, containers, firmware and OT devices.
- 3.Isolate exposed devices that cannot be patched until a vendor fix arrives.
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
8 min read at csoonline.com
Two critical vulnerabilities were announced last week in PHP, the internet’s most widely used web application runtime, and they came with the familiar warning to patch immediately. But CISOs will have to deal with the long tail of these flaws for years due to widespread PHP integration into third-party products with patching cycles customers don’t control.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.