CISA lists PHP2Shell flaws as exploited; agencies face October 29 deadline
First merged summary.
CISA has added two critical PHP remote-code bugs to its exploited catalog, and federal agencies must patch by October 29.
CISA added CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to its Known Exploited Vulnerabilities catalog. Both are CVSS 9.2 flaws in the PHP engine that let unauthenticated attackers run commands with crafted HTTP requests; public exploit code is being used against university and business sites. PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Amazon reported probing from October 17, and federal civilian agencies must remediate by October 29, 2026. The Hacker News cites Censys at more than 32.51 million services still affected, while BleepingComputer cites VirusTotal at more than 5.1 million exposed hosts. The Record says confirmed compromise remains unproven after retracted vendor claims; The Hacker News and The Register report code execution on honeypots.
- Fixed builds: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8.1 and earlier need backports or upgrades.
- CVE-2026-109618 is out-of-memory corruption; CVE-2026-109619 is stale internal request state.
- Risk is highest on Apache with PHP as mod_php; temporary upload-progress settings only reduce risk.
- Cloudflare reported attempts rising to millions by October 22; Cyfirma lists 216 hosts.
- The Record says Censys found over 10 million of 42 million internet-facing PHP services patched since October 21.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon reports PHP2Shell probing began · Cyber Security News
- Oct 21, 2026PHP ships fixes; Hunt.io logs three exploit toolkits · Cyber Security News
- Oct 22, 2026Cloudflare reports exploit attempts reaching millions · Security Affairs
- Oct 24, 2026Researcher reports remote code execution on mod_php honeypots · The Hacker News
- Oct 29, 2026Federal civilian agencies must remediate both flaws · The Hacker News
What each outlet adds
beyond the shared facts- Cyber Security NewsNames fixed releases, mod_php risk, and three October 21 toolkits.
- The Hacker NewsDefines both bug classes and cites the 32.51 million Censys figure.
- BleepingComputerSays earlier public proofs of concept were non-functional; cites 5.1 million hosts.
- Security AffairsTraces vulnerable code to PHP 5.4 and Cloudflare’s attempt surge.
- The RecordNotes retracted success claims and that KEV counts attempts as exploitation.
Coverage
oldest first · one row per article · UTC- · 16d ago
Cyber Security NewsFirst report
PHP Windows builds fix critical Brotli HTTP2Shell flaw
CVE-2026-111497, scored 9.2, is an out-of-bounds write that can crash a program, expose memory or run code.
- · 16d ago
Akamai Blog
Akamai analyzes Node2Shell flaw CVE-2026-111497
The published outline lists vulnerability details, affected versions, and mitigations, but those specifics are not in the text.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |