CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the unauthenticated remote code execution vulnerabilities, both rated CVSS 9.2. The flaws were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, federal agencies have until October 29 to apply the fixes, and Censys estimates more than 32.5 million PHP services are still running an affected version. https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
The Hacker NewsCISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionCISA adds two exploited PHP2Shell flaws to its KEV catalog after honeypot tests confirm remote code execution on a single-worker mod_php setup.