Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcritical

CISA adds both PHP2Shell flaws to KEV after attack wave

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA listed both PHP2Shell bugs as exploited after October 21 patches, millions of attempts, and a reported government breach.

The PHP Foundation issued emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, called PHP2Shell. The unauthenticated remote code execution bugs, scored 9.2, date to PHP 5.4. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Cloudflare reported attempts climbing into the millions by October 22, after an AWS-observed attempt on October 17. Wordfence and Sophos reported no confirmed compromise, while Unit 42 says attackers hit a European government entity and reached password hashes and MFA secrets within two hours. CISA listed both flaws as known exploited on October 26, with a federal due date of October 29.

Key facts
  • Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • CISA KEV due date is October 29, 2026; ransomware use is unknown.
  • Censys counted over 34.4 million vulnerable PHP services on October 23.
  • Wordfence logged more than 74,000 related attempts without a confirmed compromise.
  • VulnCheck says a private exploit gets RCE on PHP 8.4.26 x86-64 with ASLR.
  • Qualys says about 71% of observed instances run end-of-life PHP 5.4–8.1.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026AWS reported a PHP2Shell exploit attempt · CSO Online
  2. Oct 20, 2026CVE IDs circulated; Calif briefly posted a proof-of-concept · CSO Online
  3. Oct 21, 2026PHP emergency-patched both PHP2Shell flaws · SecurityWeek
  4. Oct 22, 2026Cloudflare saw exploitation attempts rise into the millions · Security Affairs
  5. Oct 23, 2026Censys counted over 34.4 million vulnerable PHP services · Security Affairs
  6. Oct 26, 2026CISA added both CVEs to the KEV catalog · CISA

What each outlet adds

beyond the shared facts
  • The Hacker NewsUnit 42 describes a European government intrusion and rapid credential access.
  • CISABoth CVEs are in KEV, due October 29; ransomware use unknown.
  • CSO OnlineEmbargo moved after Chainguard’s early images; AWS saw an October 17 attempt.
  • The RegisterVulnCheck’s private exploit targets PHP 8.4.26 x86-64; ARM64 RCE is not functional.
  • Security AffairsCensys exposure count and Cloudflare’s rise to millions of attempts.
CVEs
CVE-2026-109618CVE-2026-109619CVE-2026-115560
Vendors
PHP GroupPHPThe PHP FoundationPHP Foundation
Products
PHPWordPressDrupalJoomlaMediaWiki
Threat actors
Lazarus Group
Malware
PotassiumMirai
Victims
European government entity
Organizations
CISACloudflareCensysSophosVulnCheckArctic WolfCisco TalosChainguardAWSCalifPalo Alto Networks Unit 42CYFIRMA
Countries
North KoreaUnited StatesJapanSouth KoreaThailandIndonesiaAustraliaTaiwanIndiaSingaporeUnited Kingdom

Coverage

oldest first · one row per article · UTC
  1. · 8d ago oss-securityFirst report

    Unofficial backports posted for EOL PHP RCE flaws

    Source patches cover unauthenticated RCE CVE-2026-109618 and CVE-2026-109619, rated CVSS 4.0 9.2, where vendors will not fix.

  2. · 8d ago oss-security

    PHP team aware of CVE-2026-109619, no new plans

    A mailing-list reply says the team knows the PHP 8.2–8.5 stale-global-state report and has no new plans.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-115560
——PoC ×11—