CISA Adds Actively Exploited PHP2Shell Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that two PHP2Shell vulnerabilities have been added to its Known Exploited Vulnerabilities (KEV) catalog following confirmation of active exploitation. Both flaws, rated 9.2 on the CVSS scale, enable unauthenticated remote code execution. CVE-2026-109618 is an out-of-memory corruption issue, while CVE-2026-109619 is a stale internal request-state vulnerability.

Adel Karimi, detection and response lead at Perplexity, reported successful remote code execution against honeypot systems on October 24, 2026. > "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said. > "The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload."

Karimi added that the exploit was demonstrated on a single-worker mod_php configuration and did not assess reliability on other setups. The vulnerabilities were patched in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released on October 21, 2026, with federal agencies given until October 29, 2026 to apply the updates.

Censys estimates that more than 32.5 million PHP services continue to run affected versions, representing roughly 70% of websites. The issue has prompted advisories from numerous vendors and agencies worldwide.

Separately, the PHP Foundation released patched Windows builds on October 26, 2026 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could also lead to privilege escalation and unauthenticated remote code execution. The foundation noted that the vulnerable decoder can be accessed via the cURL extension when automatic HTTP response decompression is enabled, a setting disabled by default.