CISA confirms active exploitation of critical PHP flaws
CISA has confirmed that attackers are exploiting both critical PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities catalog. The confirmation raises the urgency for organisations running vulnerable PHP servers, since the flaws allow unauthenticated remote code execution.
The bugs, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 and were patched on 21 October. A researcher recorded 35 successful shell executions across three honeypots, while Delft University’s Threat Intelligence Lab tracked more than 50,000 exploit requests from over 600 IP addresses in 70 countries. Federal civilian agencies must patch by 29 October; recommended fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
In short
- CISA confirms both PHP2Shell flaws are being exploited.
- Federal agencies have until 29 October to patch.
- Researchers tracked over 50,000 exploitation requests.
Explained simply
PHP is software used by web servers to run parts of websites and online services. A flaw in server software can let an attacker send specially formed requests that make the server run commands, even without logging in.
CISA is the US government agency responsible for helping protect federal networks and sharing cybersecurity guidance. Its Known Exploited Vulnerabilities catalogue lists software flaws that attackers are known to be using; federal civilian agencies use it to prioritise fixes.
The issue matters to organisations running affected PHP versions because a compromised server could expose data or be used for further attacks. PHP’s maintainers have issued patched releases, and applying security updates is the main way to close these flaws.
Cybersecurity Research Science Technology
Read the full article at the source →
Originally published by The Register as “CISA confirms PHP2Shell under attack as researchers clock successful exploits”.