Vulnerability/
https://reddit.com/r/cybersecurity/comments/1xgywlp/cisa_confirms_php2shell_vulnerabilities_now/

https://reddit.com/r/cybersecurity/comments/1xgywlp/cisa_confirms_php2shell_vulnerabilities_now/: CISA confirms PHP2Shell vulnerabilities now exploited in attacks

Published Oct 27, 2026

Updated

Affected Software

1 affected component

PHP PHP

Frequently Asked Questions

Are these vulnerabilities known to be actively exploited?

Yes. CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, indicating recognized active exploitation.

Was the reported European government agency compromise confirmed to involve PHP2Shell?

No. Researchers confirmed an attack against a vulnerable PHP application, but could not establish that either PHP2Shell CVE was used for initial access; Palo Alto Networks Unit 42 retracted the earlier claim.

What remediation timeline did CISA set for federal civilian agencies?

Federal civilian agencies were directed to remediate CVE-2026-109618 and CVE-2026-109619 by October 29.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.