The US Cybersecurity and Infrastructure Security Agency (Cisa) has added the two so-called PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (Kev) catalogue after confirming live exploitation by unnamed threat actors.
The update addresses both CVE-2026-109618 – a PHP memory corruption flaw – and CVE-2026-109619 – a PHP stale internal request-state flaw.
First made public last week in a chaotic disclosure process, the PHP2Shell vulnerabilities are considered critical due to the prevalence of the open source server-side scripting language across the world wide web. Collectively, they impact a huge number of organisations.
The addition of a vulnerability to the Kev list means civilian agencies of the US federal government must apply fixes to their systems by a specific date, in this case Thursday 29 October, and is a clear signal that the flaw(s) in question are being exploited, meaning other organisations should pay attention even if they are not legally bound to do so.
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” the agency said.
Cisa, said it was not known whether or not the PHP2Shell flaws have been implicated in any ransomware campaigns. Nor did it share details of any specific cyber incidents arising from them.
However it emerged on Sunday 25 October that exploitation leading to remote code execution (RCE) had been detected against an Apache mod_php installation running version 8.4.26 of PHP in a sequestered honeypot environment.
Closed Door Security CEO William Wright said Cisa’s update had confirmed the fears that have been on many minds since PHP2Shell was made public last week.
“Before this, many security vendors had reported numerous attempts to target honeypots and servers using the vulnerabilities, though allegedly none had been successful in taking full advantage of the potential for RCE,” said Wright.
“However, CISA’s confirmation shows that the fear among experts and governments was not unjustified.
“Threat actors work rapidly and take advantage they can get, and the potential advantage here was massive, with the exploit effectively allowing attackers to control and modify any unpatched server exposed to the internet,” Wright told Computer Weekly via email.
He said that while major services have now been promptly patched, questions remain about what will happen to smaller sites and services – many of which may now not be maintained – and to instances in which PHP is hidden as part of a larger tech stack supporting other services.
Wright advised any organisations that have not yet started the process to review their systems as soon as possible to ensure they are not silently exposed to unpatched PHP deployments internally, or through third-party partners.
Time to exploit
According to CrowdStrike, full weaponisation of the PHP2Shell flaws likely took longer after disclosure because attackers would have needed to adapt the proof-of-concept exploit for the specific PHP version and application they wanted to target.
This presented a “meaningful barrier” to threat actors, the firm’s researchers said, because it meant they would have needed specific expertise on Docker containers, packages, and other elements used by the would-be victim.
Meanwhile, as of12:00pm UTC on 27 October, Infrawatch’s free PHP2Shell Tracker tool showed about 443,000 publicly visible hosts had been patched, an improvement of approximately 31,000 hosts in the past 24 hours, representing around 20% of the total. In the UK, patches have been applied to 27.2% of visible hosts and in the US, to 19.7%.
