CISA adds PHP2Shell flaws to exploited catalog, sets Thursday deadline
CISA added two critical PHP vulnerabilities tracked as PHP2Shell to its Known Exploited Vulnerabilities Catalog and told federal civilian agencies to patch by Thursday.
CISA has added two critical PHP vulnerabilities, tracked together as PHP2Shell, to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to secure their systems by Thursday, BleepingComputer reported on October 27, 2026.
The two flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to gain remote code execution on unpatched systems. CISA's catalog entry describes the attacks as high complexity. The PHP security team patched both flaws on Wednesday, October 21, a day after urging administrators to install updates as soon as they were available.
The disclosure was messy. Details leaked before patches shipped, and some proof-of-concept exploits were published online, but the PHP team said none were functional. Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack all saw widespread exploitation attempts before public disclosure and tagged them as unsuccessful. Amazon's threat intelligence researchers said attackers began targeting the flaws four days before patches were released.
Perplexity's Adel Karimi first confirmed in-the-wild exploitation after honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26.
CISA's directive applies only to federal agencies, but the agency encouraged all organizations to prioritize KEV entries. PHP underpins a large share of the web, so exposed installations deserve attention.
CVE references
Sources
- CISA confirms PHP2Shell vulnerabilities now exploited in attacksPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning