GoKawiilCISA adds PHP2Shell flaws to exploited vulnerabilities list, sets federal patch deadline
CISA has confirmed active exploitation of two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to achieve remote code execution on unpatched systems. PHP issued patches on October 21, and CISA has ordered federal civilian agencies to secure their systems by Thursday under Binding Operational Directive 26-04.
GoKawiil's interpretation of the reporting above, not reported fact.
Several security firms reportedly observed exploitation attempts even before patches were released, suggesting attackers moved quickly once details leaked, though those early attempts were said to be unsuccessful. CISA's directive only binds federal agencies, but its public warning signals that the flaws pose a broader risk, and organizations running affected PHP versions elsewhere may face similar exposure if they delay patching.
- CISA confirmed active exploitation of PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619).
- PHP released patches on October 21; federal agencies must remediate by Thursday under BOD 26-04.
- Multiple security firms detected early exploitation attempts before public disclosure, though reportedly none succeeded.
Source: bleepingcomputer.com, 2026-10-27
Published there as: “CISA confirms PHP2Shell vulnerabilities now exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.