CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of two recently patched PHP2Shell vulnerabilities, adding them to its Known Exploited Vulnerabilities catalog.
The vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments. CVE-2026-109618 involves an out-of-memory corruption vulnerability, while CVE-2026-109619 relates to a stale internal request-state vulnerability.
The confirmation follows Adel Karimi's detection of successful remote code execution against honeypot systems on October 24, 2026. Federal agencies have until October 29, 2026, to apply the necessary fixes.
Global Impact
PHP, used in approximately 70% of all websites, has seen over 32.51 million services still running affected versions according to Censys data. The severity has prompted numerous advisories from major vendors and government agencies worldwide.
Notable companies including ABB, IBM, Siemens, Okta, and WordPress have issued security alerts regarding these vulnerabilities. The PHP Foundation has also released Windows builds to address an additional Brotli decoder vulnerability (CVE-2026-111497).
Related
