The US government's cybersecurity agency has confirmed that attackers are now exploiting both critical PHP2Shell vulnerabilities in live attacks, and has ordered federal civilian agencies to patch them by Thursday 29 October. The confirmation marks a step change from last week, when the Cybersecurity and Infrastructure Security Agency warned of the danger but said it had not observed successful exploitation.

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue on Monday under Binding Operational Directive 26-04. Both flaws are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution on affected servers. Patches were released on 21 October for PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but Amazon Threat Intelligence spotted exploitation attempts as early as 17 October, four days before public disclosure.

Evidence of live shells

Perplexity security researcher Adel Karimi recorded 35 successful shell executions on 24 October across three honeypots running PHP 8.4.26 under Apache mod_php, from two IP addresses. CISA has not disclosed the attackers or the organisations affected. The agency's directive binds federal agencies only, but it urges all organisations to prioritise KEV flaws. Separately, the PHP team has shared mitigation for a new remote code flaw, CVE-2026-115560, for which no patch exists yet, affecting systems with an unusual combination of configuration and application code. Sources: The Register and BleepingComputer.