CISA lists PHP2Shell bugs as exploited; success claims conflict
First merged summary.
CISA ordered federal agencies to patch two critical PHP remote-code bugs by October 29, while reports disagree on confirmed compromises.
PHP patched CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, on October 21 in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both score CVSS 9.2 and allow unauthenticated remote code execution through crafted HTTP requests in the engine since PHP 5.4. CISA added both to the Known Exploited Vulnerabilities catalog on October 26; federal civilian agencies must remediate by October 29 under BOD 26-04, and known ransomware use is unknown. BleepingComputer and The Hacker News cite a Perplexity honeypot that reported working code execution on Apache mod_php 8.4.26. The Record says Sophos and Palo Alto Networks posted, then retracted, success claims and that confirmed compromises remain unproven. Exposure counts also differ: Censys reported over 34.4 million vulnerable services on October 23 and later about 32.51 million, while VirusTotal cited more than 5.1 million exposed hosts.
- Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- Lines 7.4, 8.0 and 8.1 need backports or a supported upgrade.
- Cloudflare reported exploit attempts reaching millions by October 22.
- Federal remediation deadline is October 29, 2026; ransomware use is unknown.
- Perplexity reported an 800 KiB cookie dump and a shell on a honeypot.
- The Record says dozens of firms logged thousands of failed attempts.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon says attackers began probing PHP2Shell. · Cyber Security News
- Oct 21, 2026PHP shipped emergency patches for both flaws. · BleepingComputer
- Oct 22, 2026Cloudflare reported millions of exploit attempts. · Security Affairs
- Oct 24, 2026Perplexity honeypot reported successful remote code execution. · The Hacker News
- Oct 26, 2026CISA added both CVEs to the KEV catalog. · CISA Known Exploited Vulnerabilities
- Oct 29, 2026Federal civilian remediation deadline under BOD 26-04. · CISA Known Exploited Vulnerabilities
What each outlet adds
beyond the shared facts- CISA Known Exploited VulnerabilitiesNames the bug classes and says ransomware use is unknown.
- The RecordSays success posts were retracted and KEV counts attempts.
- BleepingComputerHoneypot ran PHP 8.4.26; earlier public PoCs called non-functional.
- Security AffairsOctober 23 Censys count and Cyfirma’s 216-host claim.
- ESET WeLiveSecuritySays the flaws were discovered by AI and points to NCSC.
Coverage
oldest first · one row per article · UTC- · 7d ago
Security AffairsFirst report
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
- · 7d ago
Lobsters · security
Essay says AI shrank PHP2Shell exploit time to hours
The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — |