The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That's bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA's confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget,...
CISA confirms PHP2Shell under attack as researchers clock successful exploits
Affected Software
Frequently Asked Questions
Which vulnerabilities has CISA confirmed are being exploited?
CISA added CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell vulnerabilities, to its Known Exploited Vulnerabilities catalog after confirming exploitation.
What remediation deadline applies to federal civilian agencies?
Federal civilian agencies have until October 29 to address the vulnerabilities. CISA added them to the KEV catalog on Monday and gave agencies three days to patch.
How can the vulnerabilities be exploited?
Both vulnerabilities are rated 9.2 CVSS and can be exploited without authentication to run code on vulnerable PHP servers.
When did exploitation attempts begin relative to disclosure and patch availability?
AWS observed exploitation attempts as early as October 17. Patches were released on October 21, while the bugs were publicly disclosed four days after the attempts were first seen.
What changed in CISA's assessment from the previous week?
CISA had previously warned that PHP2Shell was dangerous but said it had not observed successful exploitation in the wild. Its KEV addition confirms that attackers are exploiting both vulnerabilities.