CISA confirms both PHP2Shell flaws are exploited and adds them to KEV
Original title: CISA confirms PHP2Shell under attack as researchers clock successful exploits
Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
CISA added both critical PHP2Shell bugs, CVE-2026-109618 and CVE-2026-109619, to the Known Exploited Vulnerabilities catalog on Monday and gave federal civilian agencies until October 29 to patch. Each flaw scores CVSS 9.2 and can be exploited without authentication to run code on vulnerable PHP servers. Patches landed on October 21, while AWS reported exploit attempts as early as October 17. CISA is also urging non-federal organizations to prioritize the fixes.
Unconfirmed: CISA has not named compromised organizations; honeypot results matched only CVE-2026-109618, and Sophos and Palo Alto Networks withdrew earlier success claims.
- A researcher logged 35 successful shells on three PHP 8.4.26 honeypots on October 24.
- Those honeypot attacks matched CVE-2026-109618 and did not show the second flaw.
- Delft tracked more than 50,000 requests from over 600 addresses in 70 countries.
- 171 of those addresses sent exploit code or malware droppers, not only probes.
- Systems that cannot be secured should be taken offline until the risk is addressed.
Impact: Unauthenticated remote code execution on vulnerable PHP servers
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, or 8.2.35 |
- 1.Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for the installed branch.
- 2.Federal civilian agencies must address both flaws by October 29.
- 3.Take systems that cannot be secured offline until the risk is addressed.
- Vendors
- PHP
- Organizations
- CISAAWSDelft UniversitySophosPalo Alto Networks
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at theregister.comBoth critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.