CISA Confirms Active Exploitation of Two PHP2Shell Vulnerabilities
CISA has confirmed active exploitation of two recently patched PHP vulnerabilities by adding them to its Known Exploited Vulnerabilities catalog. The confirmation followed successful remote-code-execution activity against PHP honeypots observed on October 24, 2026. The flaws allow unauthenticated attackers to execute code on affected deployments, making unpatched internet-facing PHP services a current security concern.
The vulnerabilities are CVE-2026-109618, an out-of-memory corruption issue, and CVE-2026-109619, involving stale internal request state. Both are rated 9.2 under CVSS and can result in unauthenticated remote code execution. Adel Karimi of Perplexity documented 35 launched shells across three honeypots running PHP 8.4.26; the observed attacks originated from two IP addresses.
Fixed PHP releases
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The PHP releases addressing the two PHP2Shell flaws were published on October 21, 2026. Organizations operating PHP should move to an applicable fixed release. Federal agencies have until October 29, 2026, to apply the required fixes.
Scanning data indicates that many services may still be exposing vulnerable version numbers. Censys reported more than 32.51 million PHP services running an affected version, while a separate scan found more than four million such services in Germany. These figures are indicators rather than a complete count: Linux distributions may backport security fixes to older version branches, so a reported version number does not always show whether the relevant patch is present.
The available exploitation evidence has a defined scope. The confirmed chain used a single-worker mod_php configuration that was favorable to the exploit; it does not establish reliability across other worker counts, PHP builds or applications. Operators should therefore verify the actual package or distribution patch status rather than relying only on externally observed version strings.