The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities, collectively tracked as PHP2Shell, to its catalog of security flaws known to be actively exploited. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow an unprivileged attacker to achieve remote code execution on an unpatched system, although exploiting them requires a high-complexity attack.
The PHP Security Team released patches for both vulnerabilities on Wednesday, October 21, one day after urging security teams to install the updates as soon as they became available.
PHP2Shell details leaked before the official patch
Details about the PHP2Shell vulnerabilities—including their CVE identifiers and mitigations shared with critical infrastructure providers—were leaked before the official disclosure. Several proof-of-concept (PoC) exploits were also published online before the patches were released, but the PHP Security Team said none of them worked.
Several cybersecurity companies, including Cloudflare, Amazon, Emperor Hadrian, watchTowr, Previdian and Patchstack, detected widespread attempts to exploit the vulnerabilities before publication. However, all of the observed attempts were classified as unsuccessful.
Amazon Threat Intelligence researchers said attackers began targeting PHP2Shell four days before the security patch was released.
Federal agencies ordered to apply the updates
CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26. The agency ordered Federal Civilian Executive Branch (FCEB) agencies to secure affected systems by Thursday under binding Operational Directive 26-04.
“These types of vulnerabilities are a frequent attack vector for malicious cyber attackers and pose significant risks to federal enterprises,” CISA warned.
“While BOD 26-04 applies only to FCEB institutions, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of vulnerabilities in the KEV catalog.”
CISA has not released details about the ongoing PHP2Shell attacks. However, Adel Karimi, head of detection and response at Perplexity, confirmed over the weekend that the vulnerabilities had been exploited in the wild.
Honeypot evidence of remote code execution was recorded against an Apache mod_php installation running PHP 8.4.26.
PHP exposure remains widespread
On Friday, the PHP Security Team also published mitigations for a new, unpatched remote code execution vulnerability, CVE-2026-115560. The flaw could be exploited against systems that “have an unusual combination of configuration and application code.”
PHP is used by approximately 70% of websites. Microsoft estimates that more than 5.1 million PHP hosts are exposed online, including approximately 3.8 million instances with at least one port exposed to attack, according to a VirusTotal estimate.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com