# CISA confirms active exploitation of critical PHP flaws

- URL: https://talkfuse.com/story/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/
- Published: 2026-10-27T14:45:00+00:00
- Updated: 2026-10-27T15:08:56+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/cyber-crime/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/5305681
- Topics: Cybersecurity, Research, Science, Technology

## Key points

- CISA confirms both PHP2Shell flaws are being exploited.
- Federal agencies have until 29 October to patch.
- Researchers tracked over 50,000 exploitation requests.

## Summary

CISA has confirmed that attackers are exploiting both critical PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities catalog. The confirmation raises the urgency for organisations running vulnerable PHP servers, since the flaws allow unauthenticated remote code execution.

The bugs, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 and were patched on 21 October. A researcher recorded 35 successful shell executions across three honeypots, while Delft University’s Threat Intelligence Lab tracked more than 50,000 exploit requests from over 600 IP addresses in 70 countries. Federal civilian agencies must patch by 29 October; recommended fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.