The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday 26 October 2026 confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalogue. The two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 on the CVSS scoring system and allow unauthenticated remote code execution.

What PHP2Shell is

The flaws are PHP core memory-safety bugs affecting PHP 5.4 through 8.5. Researchers reported remote code execution on honeypots on 24 October, Amazon Threat Intelligence saw exploitation attempts as early as 17 October, before patches were available, and Cloudflare later logged millions of attempts. Check Point said 10% of organisations worldwide were impacted, with 14% in Europe. PHP has published fixed releases for 8.5.12, 8.4.27, 8.3.36 and 8.2.35; older branches remain vulnerable.

Patch deadline 29 October

CISA's KEV listing gives US federal civilian agencies until Thursday 29 October to remediate. Site owners running Apache with mod_php are urged to patch immediately: one unauthenticated request can trigger exploitation before an application even runs, though reliability depends on worker count and build options. Siemens, Schneider Electric, ABB and multiple agencies have also published advisories. CISA also added an Arista VeloCloud Orchestrator SQL injection flaw and a Collabora Online command injection flaw to the KEV catalogue in the same update cycle, underlining that the PHP flaws are part of a wider active-exploitation picture.

Sources: CISA via The Hacker News; Softonic cyber report, 27 October 2026.