CISA says PHP2Shell flaws are exploited for remote code execution
Original title: CISA confirms PHP2Shell vulnerabilities now exploited in attacks
FCEB agencies must remediate CVE-2026-109618 and CVE-2026-109619 by Thursday; a separate RCE still has no patch.
CISA added two critical PHP flaws tracked as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to the Known Exploited Vulnerabilities Catalog. Unprivileged attackers can use the high-complexity bugs for remote code execution on unpatched systems. The PHP security team patched them on October 21. Under BOD 26-04, federal civilian agencies must secure systems by Thursday. Perplexity’s Adel Karimi reported honeypot evidence of code execution against Apache mod_php running PHP 8.4.26. PHP also shared mitigation, but no patch, for a separate RCE, CVE-2026-115560.
Unconfirmed: CISA has not published further details of the ongoing PHP2Shell attacks beyond the KEV listing.
- Earlier public proof-of-concept exploits were called non-functional by the PHP security team.
- Amazon said attackers began targeting PHP2Shell four days before patches shipped.
- VirusTotal estimates more than 5.1 million PHP hosts are exposed online.
- CVE-2026-115560 is exploitable only with an unusual configuration and application-code mix.
Impact: Remote code execution without privileges on unpatched PHP
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | patches released October 21 |
- 1.Install the PHP security updates released October 21 for the PHP2Shell flaws.
- 2.FCEB agencies must secure affected systems by Thursday under BOD 26-04.
- 3.Apply the PHP team’s mitigation for unpatched CVE-2026-115560.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.