CISA confirms PHP2Shell flaws are being exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities, tracked together as PHP2Shell, to its Known Exploited Vulnerabilities Catalog. CISA directed Federal Civilian Executive Branch agencies to secure their systems by Thursday under Binding Operational Directive 26-04.

The flaws, CVE-2026-109618 and CVE-2026-109619, can let attackers without privileges run code remotely on unpatched systems. The PHP security team released fixes on Wednesday, October 21. Before the patches became available, details leaked and proof-of-concept exploits appeared online, but the PHP team said none worked. Several cybersecurity firms reported exploitation attempts before public disclosure and described them as unsuccessful. Amazon Threat Intelligence researchers said targeting began four days before patches were released.

Over the weekend, Perplexity detection and response lead Adel Karimi confirmed in-the-wild exploitation, after honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26. CISA has not shared further details about the attacks.

Separately, on Friday, the PHP security team disclosed another remote code execution flaw, CVE-2026-115560, for which no patch was available. It affects systems with an unusual combination of configuration and application code.

VirusTotal estimates that PHP powers roughly 70% of websites. It estimates more than 5.1 million PHP hosts are exposed online, with around 3.8 million instances having at least one port open to attacks.