GoKawiilCISA adds PHP2Shell flaws to exploited vulnerabilities list, sets federal patch deadline
CISA has confirmed active exploitation of two critical PHP vulnerabilities, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated attackers to achieve remote code execution on unpatched systems. PHP issued patches on October 21, and CISA has ordered federal civilian agencies to secure their systems by Thursday under Binding Operational Directive 26-04.