PHP2Shell KEV Exploitation Hits European Government as CISA Urges Immediate PHP Patching

CISA KEV adds PHP CVE-2026-109618/109619; PHP2Shell hits a European government. Patch internet-facing PHP, revoke sessions, hunt logs.

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog; both are unauthenticated remote code execution flaws in PHP.
Reported PHP2Shell exploitation against a European government entity included agentic AI-assisted post-exploitation, making internet-facing PHP an urgent priority.
Also this week: Microsoft 365 token-replay attacks compromised 97 accounts at 79 organizations, and Fortinet released critical FortiOS hardening without CVE details until November 10, 2026.

What to do now

Inventory every PHP runtime, framework, custom application, and third-party hosted portal; record version, owner, and whether it is reachable from the internet.
Apply the PHP security release that fixes CVE-2026-109618 and CVE-2026-109619 now, starting with internet-facing and authenticated-session services; where patching is impossible, add WAF/virtual-patching controls and restrict access to trusted networks.
Revoke active sessions and rotate session-signing keys, application secrets, and service credentials on any PHP system that may have processed untrusted requests; force reauthentication for privileged users.
Hunt web and system logs for PHP2Shell exploit attempts, out-of-memory crashes, unexpected child processes, webshells, and anomalous session-token use; isolate and reimage confirmed compromised hosts.
For Microsoft 365, revoke refresh tokens and enforce phishing-resistant MFA and conditional access; for Fortinet edge devices, apply the latest hardening updates and restrict management interfaces to trusted networks.