CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the unauthenticated remote code execution vulnerabilities, both rated CVSS 9.2. The flaws were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, federal agencies have until October 29 to apply the fixes, and Censys estimates more than 32.5 million PHP services are still running an affected version.