The United States Cybersecurity and Infrastructure Security Agency has confirmed that attackers are exploiting two critical flaws in the PHP programming language, and has given federal civilian agencies until Thursday 29 October to address them. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as PHP2Shell, were added to the agency's Known Exploited Vulnerabilities catalogue on 26 October. That step marked a change from 21 October, when the agency had warned about the danger but said it had not yet seen successful exploitation. The PHP project released fixes on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What the flaws allow

Both flaws can allow an attacker without any login to run code on a vulnerable server, which is why they are treated as so serious. One involves memory corruption when the system runs out of memory, while the other involves stale request state being carried across requests. Evidence reported since the patches includes successful code execution in research honeypots: a Perplexity researcher recorded 35 successful shell executions on 24 October across honeypots running PHP 8.4.26 under Apache.

What operators should do

Operators should move to a fixed PHP version, confirm which version the web server actually loads rather than only the command-line version, and rebuild or restart services as their setup requires. Any server that was exposed and unpatched after exploitation began should be checked for planted files, new PHP files in web roots and unexpected scheduled jobs before it is treated as clean. The 29 October date is a federal-agency deadline, not a legal deadline for private firms, but CISA urges all organisations to prioritise catalogue flaws. Older branches such as PHP 8.1 and earlier have no fixed build, so those systems need an upgrade, not a patch.

Sources: The Register and MLQ News.