Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA Adds PHP2Shell RCE Flaws to KEV Amid Wild Exploitation

17 sources · 30 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) to KEV October 26 after in-the-wild RCE exploitation; patches released October 21 with federal deadline October 29.

CISA added two critical unauthenticated RCE vulnerabilities in PHP engines (CVE-2026-109618 memory corruption and CVE-2026-109619 stale request state) to its Known Exploited Vulnerabilities catalog on October 26. Both flaws, scored 9.2, allow remote code execution on unpatched PHP versions dating to 5.4. Patches were released October 21 for supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12); confirmed exploitation occurred on Apache mod_php servers per Perplexity honeypots and public exploit code. Federal civilian agencies must remediate by October 29 under BOD 26-04. Some reports note chaining with Linux kernel CVE-2026-46300 for root access in specific attacks.

Key facts
  • CVE-2026-109618: out-of-memory corruption enabling unauthenticated RCE
  • CVE-2026-109619: stale internal request-state bug enabling unauthenticated RCE
  • Patches shipped October 21 for PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
  • CISA KEV added October 26; federal remediation deadline October 29
  • Confirmed exploitation on Apache mod_php PHP 8.4.26 honeypots October 24
  • Chaining with CVE-2026-46300 reported in government-affiliated breach October 25
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Amazon reports probing for PHP2Shell exploits on October 17 · Cyber Security News
  2. Oct 21, 2026PHP releases emergency patches for CVE-2026-109618 and CVE-2026-109619 · BleepingComputer
  3. Oct 24, 2026Perplexity confirms working RCE and 800 KiB cookie dump on PHP 8.4.26 · BleepingComputer
  4. Oct 26, 2026CISA adds CVE-2026-109618 and CVE-2026-109619 to KEV catalog · The Hacker News
  5. Oct 28, 2026CISA adds Linux kernel CVE-2026-46300 noting PHP2Shell chaining · CISA
  6. Oct 28, 2026Dream reports 25 servers rooted using PHP2Shell plus Linux kernel flaw · The Hacker News

What each outlet adds

beyond the shared facts
  • BleepingComputerDetailed honeypot RCE confirmation with cookie dump and researcher quotes
  • The Hacker NewsCISA KEV confirmation plus Censys exposure estimates and Windows Brotli fixes
  • Security AffairsCloudflare traffic spike to millions of attempts and Cyfirma unpatched host count
  • The RegisterResearcher shell logs and Delft request tracking from 600+ addresses
  • The Hacker NewsSpecific government-affiliated breach details using custom exploit and AI tools
CVEs
CVE-2026-109618CVE-2026-109619CVE-2026-111497CVE-2026-115560CVE-2026-46300
Vendors
PHP FoundationPHPPHP Group
Products
PHPBrotliApache mod_phpLinux kernelClaude CodeLinux Kernel
Malware
MiraiPotassium
Victims
U.S. government-affiliated organization
Organizations
CISAPerplexityCensysCloudflareCyfirmaAkatsuki LegionAmazon Threat IntelligenceSophosHunt.ioExpelDataminrDream
Countries
United StatesNorth KoreaUkraineJapanTaiwanSouth KoreaChina
AI models
DeepSeekKimi

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    PHP2Shell exploited at a European government entity, Unit 42 says

    Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.

  2. · 6d ago CISA Known Exploited Vulnerabilities

    CISA KEV lists PHP request-state flaw enabling unauthenticated RCE

    CVE-2026-109619 is a stale internal request-state bug; the federal remediation due date is October 29.

  3. · 6d ago CISA Known Exploited Vulnerabilities

    CISA KEV lists PHP memory-corruption flaw enabling unauthenticated RCE

    CVE-2026-109618 is an out-of-memory corruption bug; federal due date is October 29, and ransomware use is unknown.

  4. · 5d ago Cyber Security News

    Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC

    CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.

  5. · 5d ago GBHackers

    Public PoC exploits PHP2Shell for RCE on PHP 8.4.26

    The PoC is tuned for Alpine PHP 8.4.26 and succeeded in seven of ten lab runs.

  6. · 5d ago GBHackers

    Public PHP2Shell scripts drive mass scans of internet-facing PHP

    Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.

  7. · 5d ago The Register · Security

    PHP2Shell flaws allow unauthenticated RCE; wild attacks reported

    Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.

  8. · 5d ago Infosecurity Magazine

    PHP urges workaround for unpatched RCE CVE-2026-115560

    The bug needs a rare runtime switch of the session serialize handler and will not be fixed until the next release.

  9. · 5d ago BleepingComputer

    PHP2Shell RCE flaws confirmed exploited against PHP 8.4.26

    A Perplexity honeypot saw working RCE and an 800 KiB cookie dump on Apache mod_php; a separate unpatched RCE still needs a config workaround.

  10. · 5d ago Security Affairs

    Suspected North Korean campaign targets 216 vulnerable PHP hosts

    Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.

  11. · 5d ago ESET WeLiveSecurity

    Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution

    Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.

  12. · 5d ago SecurityWeek

    PHP2Shell exploitation confirmed with working shells on honeypots

    Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots; CISA had not added the flaws to KEV.

  13. · 5d ago SecurityWeek

    Industrial vendors assess PHP2Shell; several OT products affected

    Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.

  14. · 5d ago Tenable Blog

    Tenable outlines detection and patching for PHP2Shell

    CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.

  15. · 5d ago Cyber Security News

    Attackers use public PHP2Shell exploits against university and business sites

    CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.

  16. · 4d ago The Hacker News

    CISA confirms active exploitation of two PHP2Shell RCE flaws

    Both flaws score CVSS 9.2; fixes shipped October 21, and US agencies must patch by October 29.

  17. · 4d ago Full Disclosure

    PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)

    Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.

  18. · 4d ago BleepingComputer

    CISA says PHP2Shell flaws are exploited for remote code execution

    FCEB agencies must remediate CVE-2026-109618 and CVE-2026-109619 by Thursday; a separate RCE still has no patch.

  19. · 4d ago Security Affairs

    CISA adds exploited PHP2Shell flaws to its KEV catalog

    Unauthenticated HTTP requests can run code on PHP engines dating to PHP 5.4; agencies must fix by October 29, 2026.

  20. · 4d ago Cloudflare Blog

    Cloudflare opens PHP CTF for php2shell WAF bypasses

    HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.

  21. · 4d ago The Record

    CISA orders agencies to patch two targeted PHP bugs by Thursday

    CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.

  22. · 4d ago Wiz Blog

    Wiz reports limited PHP2Shell exploitation attempts after disclosure

    Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.

  23. · 4d ago The Register · Security

    CISA confirms both PHP2Shell flaws are exploited and adds them to KEV

    Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

  24. · 4d ago Hacker News · AI

    PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js

    GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.

  25. · 4d ago CISA Known Exploited Vulnerabilities

    CISA KEV: Linux kernel CVE-2026-46300 due October 31

    The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.

  26. · 3d ago Lobsters · security

    Blog argues rapid disclosures leave defenders unable to keep up

    A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.

  27. · 3d ago Cyber Security News

    CISA says PHP2Shell flaws are exploited for remote code execution

    Federal civilian agencies must mitigate CVE-2026-109618 and CVE-2026-109619 or remove affected products by October 29.

  28. · 3d ago ESET WeLiveSecurity

    ESET reviews a week of PHP, kernel, and LiteLLM incidents

    PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.

  29. · 3d ago SecurityWeek

    China-linked hackers root firewalls via PHP2Shell and Fragnesia

    Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.

  30. · 3d ago The Hacker News

    PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts

    Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV
CVE-2026-115560
——PoC ×11—
CVE-2026-46300
Shared-frag marker loss in Linux kernel skb coalescing (LPE)
7.816%KEVPoC
KEV