CISA Adds PHP2Shell PHP Flaws to KEV as Active Exploitation Is Confirmed

CISA adds PHP2Shell PHP flaws CVE-2026-109618 and CVE-2026-109619 to KEV, confirming active exploitation. Schools and government must patch PHP now.

• CISA added two critical PHP2Shell PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on Oct. 26, citing active exploitation.
• Both are rated CVSS 9.2 and are described as enabling unauthenticated remote code execution; federal agencies were given until Thursday to patch.
• Any school or government service that runs PHP, including CMS, portals, appliances and vendor-hosted apps, should treat this as emergency patching and hunt for webshell activity.

What to do now

1. Inventory every PHP runtime and PHP2Shell deployment today, including internet-facing sites, intranet apps, containers, appliances, third-party CMS/LMS packages and vendor-bundled builds; record versions, owners and exposure.
2. Apply the vendor-fixed PHP release for CVE-2026-109618 and CVE-2026-109619 immediately, starting with internet-facing and authenticated-session services; if no patch is available, take the service offline or restrict it at the perimeter.
3. Use WAF or reverse-proxy rules only as a temporary control: block exploit patterns and restrict PHP2Shell administrative paths to trusted networks; do not treat virtual patching as closure.
4. Hunt web, PHP, process and file-integrity logs for code-execution attempts, memory-exhaustion crashes, unexpected child processes, newly written web files and webshell indicators; isolate suspicious hosts and preserve evidence.
5. Given the session-state nature of the second flaw, rotate session signing keys, secrets and credentials on any host that processed untrusted requests or shows signs of compromise; invalidate sessions, verify with an authenticated rescan, and document completion for governance and KEV reporting.

Related items

• CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
• CISA confirms PHP2Shell vulnerabilities now exploited in attacks
• CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
• U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
• CISA confirms PHP2Shell under attack as researchers clock successful exploits
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
• Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability