CISA lists PHP2Shell as exploited; federal deadline is October 29
First merged summary.
CISA added two critical PHP engine bugs, PHP2Shell, to its exploited-vulnerability catalog, with a federal fix deadline of October 29.
CISA added CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, to the Known Exploited Vulnerabilities catalog on October 26. US civilian federal agencies must apply fixes by October 29, 2026, under BOD 26-04, or stop using the product. Both flaws score CVSS 9.2 and allow unauthenticated remote code execution in the PHP engine, with vulnerable code dating to PHP 5.4; patched releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35 from October 21. Amazon reported probing from October 17, and Cloudflare said attempts reached millions by October 22. BleepingComputer, The Hacker News, and The Register describe October 24 honeypot compromises on PHP 8.4.26 mod_php, while The Record says confirmed success remains unproven after Sophos and Palo Alto Networks retracted claims.
- CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale request state.
- Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- PHP 8.1 and earlier need a vendor backport or supported upgrade.
- Censys estimates more than 32.51 million services still run affected versions.
- Known ransomware campaign use is listed as unknown.
- Risk is highest for Apache servers running PHP as mod_php.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon reported exploit probing had begun. · Cyber Security News
- Oct 21, 2026PHP shipped emergency patches for both flaws. · BleepingComputer
- Oct 22, 2026Cloudflare reported exploit attempts reaching millions. · Security Affairs
- Oct 24, 2026Honeypots recorded successful remote code execution. · The Hacker News
- Oct 26, 2026CISA added both PHP flaws to its KEV catalog. · CISA
- Oct 29, 2026Federal civilian agencies face the remediation deadline. · CISA
What each outlet adds
beyond the shared facts- BleepingComputerPerplexity honeypot saw RCE on PHP 8.4.26 mod_php.
- Cyber Security NewsHunt.io saw three toolkits; Sophos found no Mirai compromise.
- Security AffairsVulnerable code dates to PHP 5.4; Cyfirma listed 216 hosts.
- The RecordSophos and Palo Alto retracted success claims; many attempts failed.
- The RegisterResearcher logged 35 shells matching only CVE-2026-109618.
Coverage
oldest first · one row per article · UTC- · 6d ago
TechCrunch · SecurityFirst report
PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
- · 6d ago
Equity podcast debates PHP flaws, disclosure panic and attack attempts
Cloudflare's CEO is cited as seeing PHP2Shell attack attempts climb into the millions after an embargo broke.
- · 6d ago
oss-security
Unofficial patch targets PHP2Shell OOM in PHP 5.4–5.6
The community backport covers unsupported PHP 5.4, 5.5, and 5.6 for CVE-2026-109618 and CVE-2026-109619.
- · 5d ago
The Hacker News
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
- · 5d ago
CISA Known Exploited Vulnerabilities
CISA KEV lists PHP request-state flaw enabling unauthenticated RCE
CVE-2026-109619 is a stale internal request-state bug; the federal remediation due date is October 29.
- · 5d ago
CISA KEV lists PHP memory-corruption flaw enabling unauthenticated RCE
CVE-2026-109618 is an out-of-memory corruption bug; federal due date is October 29, and ransomware use is unknown.
- · 5d ago
Cyber Security News
Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.
- · 5d ago
GBHackers
Public PoC exploits PHP2Shell for RCE on PHP 8.4.26
The PoC is tuned for Alpine PHP 8.4.26 and succeeded in seven of ten lab runs.
- · 5d ago
Public PHP2Shell scripts drive mass scans of internet-facing PHP
Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.
- · 5d ago
The Register · Security
PHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
- · 5d ago
Infosecurity Magazine
PHP urges workaround for unpatched RCE CVE-2026-115560
The bug needs a rare runtime switch of the session serialize handler and will not be fixed until the next release.
- · 5d ago
BleepingComputer
PHP2Shell RCE flaws confirmed exploited against PHP 8.4.26
A Perplexity honeypot saw working RCE and an 800 KiB cookie dump on Apache mod_php; a separate unpatched RCE still needs a config workaround.
- · 5d ago
Security Affairs
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
- · 5d ago
ESET WeLiveSecurity
Critical PHP flaws dubbed PHP2Shell allow unauthenticated code execution
Early exploit attempts followed disclosure, and some sites went offline while owners applied patches.
- · 5d ago
SecurityWeek
PHP2Shell exploitation confirmed with working shells on honeypots
Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots; CISA had not added the flaws to KEV.
- · 4d ago
Industrial vendors assess PHP2Shell; several OT products affected
Unauthenticated PHP RCE flaws drew millions of attempts, with the first confirmed attacks aimed at honeypots.
- · 4d ago
Tenable Blog
Tenable outlines detection and patching for PHP2Shell
CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.
- · 4d ago
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
- · 4d ago
CISA confirms active exploitation of two PHP2Shell RCE flaws
Both flaws score CVSS 9.2; fixes shipped October 21, and US agencies must patch by October 29.
- · 4d ago
PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
- · 4d ago
CISA says PHP2Shell flaws are exploited for remote code execution
FCEB agencies must remediate CVE-2026-109618 and CVE-2026-109619 by Thursday; a separate RCE still has no patch.
- · 4d ago
CISA adds exploited PHP2Shell flaws to its KEV catalog
Unauthenticated HTTP requests can run code on PHP engines dating to PHP 5.4; agencies must fix by October 29, 2026.
- · 4d ago
Cloudflare Blog
Cloudflare opens PHP CTF for php2shell WAF bypasses
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
- · 4d ago
The Record
CISA orders agencies to patch two targeted PHP bugs by Thursday
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
- · 4d ago
Wiz Blog
Wiz reports limited PHP2Shell exploitation attempts after disclosure
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
- · 3d ago
CISA says attackers are exploiting critical PHP2Shell bugs
US civilian federal agencies have three days to patch passwordless remote break-ins in widely used PHP.
- · 3d ago
CISA confirms both PHP2Shell flaws are exploited and adds them to KEV
Federal civilian agencies must fix CVE-2026-109618 and CVE-2026-109619 by October 29; patched builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- · 3d ago
Hacker News · AI
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
- · 3d ago
DataBreaches.net
GitLab patches max-severity regex compiler RCE (CVE-2026-110264)
Unauthenticated users can run code via integer overflow when a crafted regular expression is compiled.
- · 3d ago
CISA KEV: Linux kernel CVE-2026-46300 due October 31
The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |