CISA adds two critical PHP2Shell flaws to exploited vulnerabilities list, sets federal patch deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on its Known Exploited Vulnerabilities (KEV) catalog. Federal civilian agencies now have until Oct. 29 to remediate the flaws, which are rated 9.2 on the CVSS scale and can be exploited without authentication to execute code on vulnerable PHP servers.

Patches for the affected PHP versions were released on Oct. 21, but Amazon Web Services observed exploitation attempts as early as Oct. 17, before the vulnerabilities were publicly disclosed. Security researcher Adel Karimi recorded 35 successful shell executions on honeypots running PHP 8.4.26, attributing the activity to CVE-2026-109618. Separate monitoring by Delft University’s Threat Intelligence Lab identified more than 50,000 exploitation requests from over 600 IP addresses in 70 countries, with 171 addresses delivering exploit code or malware droppers.

Earlier reports of successful attacks were later revised; Sophos reclassified its findings as scanning activity, and Palo Alto Networks withdrew claims linking the flaws to an intrusion at a European government agency. CISA did not disclose specific compromised organizations but confirmed that the vulnerabilities are being actively exploited.

CISA urges all organizations, including those outside the federal government, to prioritize updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the release branch. Systems running older, unsupported PHP versions should consider taking them offline until they can be secured.