Cybersecurity
CISA adds PHP2Shell flaws to exploited list
CISA placed two PHP vulnerabilities known as PHP2Shell on its exploited-flaws catalogue after reports of attack activity, while the PHP team said the issues had been patched and earlier proof-of-concepts were not working.
- CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities Catalog.
- The PHP security team patched the two flaws on 21 October after urging teams to install the updates when they became available.
- CISA told Federal Civilian Executive Branch agencies to fix the issues by Thursday under Binding Operational Directive 26-04.
- Several security firms said they saw attempted exploitation before disclosure, but they said those attempts were unsuccessful.
CISA added the two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities Catalog. It also ordered Federal Civilian Executive Branch agencies to remediate them by Thursday under Binding Operational Directive 26-04.
The PHP security team released fixes on 21 October, one day after asking security teams to apply the updates as soon as they were available. It said details had leaked before release, but that the proof-of-concept code circulating online did not work.
Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack all reported attempted exploitation before public disclosure, and each said the attempts did not succeed. Amazon Threat Intelligence said attackers began probing the flaws four days before the patches were released.
Perplexity detection and response lead Adel Karimi said honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26. On Friday, the PHP security team also circulated mitigation advice for CVE-2026-115560, a separate remote code execution flaw with no patch.
Named in this story
People
- Adel Karimi
- the detection and response lead who reported honeypot evidence of remote code execution
Companies
- Cloudflare
- one of the firms that said it saw attempted exploitation
- Amazon
- one of the firms that said it saw attempted exploitation
- Hadrian
- one of the firms that said it saw attempted exploitation
- watchTowr
- one of the firms that said it saw attempted exploitation
- Previdian
- one of the firms that said it saw attempted exploitation
- Patchstack
- one of the firms that said it saw attempted exploitation
- Perplexity
- the company whose detection and response lead reported honeypot evidence
Organisations
- PHP security team
- the group that patched the flaws and shared mitigation advice
- Amazon Threat Intelligence
- the security research unit that said attackers started targeting the flaws four days before patches
Governments and agencies
- CISA
- the US cyber agency that added the flaws to its exploited list and set the Thursday deadline
- Federal Civilian Executive Branch agencies
- the federal agencies told to secure their systems by Thursday
- Binding Operational Directive 26-04
- the directive CISA cited for the Thursday remediation deadline
Products and systems
- CVE-2026-109618
- one of the two PHP flaws in the story
- CVE-2026-109619
- the other PHP flaw in the story
- Apache mod_php
- the installation type that Karimi said was targeted
- PHP 8.4.26
- the PHP version running on the targeted installation
- CVE-2026-115560
- the separate PHP remote code execution flaw that the team later mitigated
How the source tells it
Plain, procedural reporting with no distinct emotive framing.
No emotive framing was found in the original.