The US Cybersecurity and Infrastructure Security Agency has added two critical PHP vulnerabilities, jointly known as PHP2Shell, to its Known Exploited Vulnerabilities catalogue after confirming real-world exploitation. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers remotely execute code on vulnerable PHP web servers.

Two flaws, confirmed exploitation

Addition to the catalogue is CISA's signal that exploitation is not theoretical: the flaws have been seen used in attacks, so patching moves from routine maintenance to urgent. Administrators should identify PHP web servers in their estate, apply the relevant vendor patches promptly, and check for signs of compromise, including unexpected files and unusual processes, rather than assuming a server is safe because it has not shown symptoms.

Patch first, check for compromise

PHP2Shell arrives in a week dominated by flaws in trusted components: a critical flaw in Google's Brotli compression library, CVE-2026-111497, is also on CISA's exploited list, with Node.js, PHP for Windows and .NET all shipping fixes, and Microsoft releasing emergency .NET security updates. The pattern is the same in each case: attackers go through widely used libraries and server software instead of breaking down the front door, so keeping dependencies patched matters as much as perimeter defence.

Sources: IT Security News and IT Security News morning roundup.