The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities, collectively known as PHP2Shell, to its catalog of security flaws exploited in real-world attacks, urging organizations to prioritize patching vulnerable systems.
Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws could allow unauthenticated attackers to execute arbitrary code remotely on vulnerable systems. Exploiting them requires a high-complexity attack, but successful exploitation could give attackers a way to compromise unpatched servers.
The PHP security team released emergency patches on October 21, a day after warning administrators that fixes were on the way. Details about the vulnerabilities, including their CVE identifiers and mitigation guidance shared with critical infrastructure providers, leaked before the patches became available. Proof-of-concept exploits also appeared online, although the PHP security team said the publicly available versions were not functional.
Several cybersecurity companies, including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack, detected exploitation attempts before the vulnerabilities were publicly disclosed. These attempts were initially assessed as unsuccessful. Amazon Threat Intelligence researchers also reported that attackers began targeting the flaws four days before the security updates were released.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26 and directed Federal Civilian Executive Branch agencies to remediate them by Thursday under Binding Operational Directive 26-04. The agency warned that vulnerabilities listed in the catalog are a frequent attack vector for malicious actors and pose significant risks to government systems. Although the directive applies to federal agencies, CISA encouraged all organizations to prioritize remediation based on risk.
Evidence of successful exploitation emerged over the weekend when Perplexity detection and response lead Adel Karimi reported that honeypots had recorded remote code execution against an Apache mod_php installation running PHP 8.4.26. The findings provided evidence that attackers had moved beyond unsuccessful attempts and were exploiting the vulnerabilities in real-world environments.
The PHP security team also disclosed a separate remote code execution vulnerability, CVE-2026-115560, on October 23. At the time of disclosure, no patch was available. The issue reportedly requires an unusual combination of application code and system configuration to exploit, and administrators were advised to follow the team’s mitigation guidance.
PHP remains a major component of the web ecosystem, powering roughly 70% of websites, according to W3Techs. VirusTotal estimates indicate that more than 5.1 million PHP hosts are exposed online, with approximately 3.8 million instances having at least one port open to potential attacks. These figures highlight the importance of identifying vulnerable deployments, applying available security updates, and reviewing server logs for suspicious activity.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
