CISA adds PHP2Shell CVE-2026-109618/109619 to KEV catalog with federal patch deadline

The US Cybersecurity and Infrastructure Security Agency has officially added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Both flaws, collectively dubbed PHP2Shell, carry a CVSS score of 9.2 and enable unauthenticated remote code execution on vulnerable PHP servers. CISA has given federal civilian agencies until October 29 to apply patches, marking a significant escalation from the agency's position last week when it had only warned of potential danger without confirmed exploitation.

Security researchers have documented substantial attack activity: Perplexity's Adel Karimi observed 35 successful shell executions across honeypots running PHP 8.4.26 under Apache mod_php, while Delft University's Threat Intelligence Lab tracked over 50,000 exploitation requests from more than 600 IP addresses across 70 countries, with 171 addresses actively delivering exploit code or malware droppers. AWS had detected exploitation attempts as early as October 17, four days before public disclosure. Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Vulnerability details and exploitation timeline

• CVE identifiers and severity: CVE-2026-109618 and CVE-2026-109619 are both rated 9.2 CVSS, classified as critical, and allow unauthenticated remote attackers to execute arbitrary code on affected PHP servers.
• Attack vector: Exploitation relies on memory exhaustion and disclosure techniques to achieve remote code execution, as observed in honeypot tests against PHP 8.4.26 running under Apache mod_php with a single-worker configuration.
• Pre-disclosure exploitation: AWS identified exploitation attempts beginning October 17, four days before the October 21 patch release and public disclosure, indicating advance attacker knowledge or discovery.
• Confirmed successful exploitation: Perplexity researcher Adel Karimi documented 35 successful shell executions from two IP addresses between October 24, with post-exploitation activity including attempts to contact external servers via PHP, curl, and wget.
• Patch availability: Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; older unsupported versions require upgrade or vendor-supported fixes, with CISA advising vulnerable systems be taken offline if patching is not immediately feasible.

Why it matters

PHP remains foundational to a substantial portion of the web, making these vulnerabilities particularly dangerous for shared hosting providers, content management systems, and legacy applications that may lag behind current release branches. Linux distribution maintainers and system administrators face compressed timelines to test and deploy updates, especially for long-term support releases, while the confirmed pre-disclosure exploitation means organizations relying on standard patch cycles may already be compromised.