CISA, security researchers confirm successful exploitation of PHP flaws - Cybersecurity Dive
Security researchers and U.S. government authorities have confirmed the first successful exploitation of critical vulnerabilities in PHP, with hackers achieving remote-code execution.
For more than a week, hackers have attempted to exploit two critical PHP vulnerabilities: CVE-2026-109618 (memory-corruption) and CVE-2026-109619 (stale internal request-state). Researchers at Perplexity uncovered the first successful exploitation, with honeypot sensors detecting remote-code execution capabilities.
Confirmed Exploitation
The security community has been under increased scrutiny as earlier threat warnings were slow to materialize. Perplexity's detection team confirmed the exploitation went beyond simple crashes, achieving actual remote code execution.
This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process.
Government Response
The Cybersecurity and Infrastructure Security Agency added the two flaws to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation. The PHP vulnerabilities raised alarms throughout the cybersecurity community as the scripting language powers roughly 70% of websites globally.
Research Challenges
Marcus Hutchins of Expel backed up Perplexity's findings, calling it the "highest-quality confirmation" of PHP exploitation he had seen. However, the research community faces criticism for the quality of initial proofs of concept, with Shadowserver Foundation reporting 263,000 end-of-life PHP instances in the U.S. alone that remain vulnerable.
Related
