CISA catalogs exploited PHP2Shell bugs; federal deadline is October 29
First merged summary.
CISA has cataloged two actively exploited PHP remote-code bugs, PHP2Shell, and federal agencies must remediate them by October 29.
PHP released fixes on October 21 for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, two CVSS 9.2 unauthenticated remote code execution bugs affecting earlier releases. Fixed builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Perplexity’s Adel Karimi reported working shells on Apache mod_php honeypots on October 24, and Unit 42 said a European government network was reached within two hours. SecurityWeek reports CISA said on October 23 it had not seen successful exploitation; on October 26 CISA added both flaws to KEV, with a federal deadline of October 29 and ransomware use unknown. A separate bug, CVE-2026-115560, remains unpatched.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots.
- Unit 42 says password hashes and MFA secrets were reached within two hours.
- Amazon says probing began October 17, four days before patches.
- Censys estimates more than 32.51 million PHP services remain affected.
- CVE-2026-115560 has no patch; PHP advises disabling session upload progress.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon says attackers began probing PHP2Shell. · Cyber Security News
- Oct 20, 2026PHP asked administrators to prepare for patches. · BleepingComputer
- Oct 21, 2026PHP shipped fixes for both PHP2Shell flaws. · BleepingComputer
- Oct 23, 2026CISA said it had not seen successful exploitation. · SecurityWeek
- Oct 24, 2026Karimi logged working shells on three honeypots. · SecurityWeek
- Oct 26, 2026CISA added both CVEs to the KEV catalog. · CISA Known Exploited Vulnerabilities
What each outlet adds
beyond the shared facts- The Hacker NewsUnit 42 government intrusion and CYFIRMA’s moderate-confidence Lazarus scanning claim.
- SecurityWeek35 honeypot shells and CISA’s October 23 statement of no success.
- CISA Known Exploited VulnerabilitiesKEV due date of October 29 and unknown ransomware use.
- BleepingComputerUnpatched CVE-2026-115560 workaround and VirusTotal’s 5.1 million-host estimate.
- The RegisterSource backports for PHP 7.4, 8.0, and 8.1, and watchTowr’s October 21 honeypots.
- Vendors
- PHP FoundationPHPPHP GroupSiemensSchneider ElectricABBRockwell AutomationJohnson ControlsBeldenHMS NetworksWibu-SystemsHitachi Energy
- Products
- PHPBrotliApache mod_phpPHP-FPMmod_phpEcoStruxure Security ExpertProLeiT LINEoptimizeEcoStruxure Control EngineeringRuggedcom APE1808PAN-OSAPROLIllustra
- Threat actors
- Lazarus Group
- Victims
- European government entity
Coverage
oldest first · one row per article · UTC- · 7d ago
Cyber Security NewsFirst report
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
- · 7d ago
oss-security
Red Hat says default RHEL 7 PHP 5.4.16 is vulnerable to CVE-2026-109619
An October 23 note says updated RHSB-2026-013 and VEX data reverse an earlier PHP 5 risk claim.
- · 7d ago
PHP 8.2–8.5 stale-state RCE cited again (CVE-2026-109619)
The follow-up only links CrowdStrike's blog and gives no patch or attack details.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — |