CISA Flags Actively Exploited PHP2Shell Flaw With 9.2 CVSS Score

Key points

• Two PHP2Shell vulnerabilities, tracked as CVE-2026-109618, carry a 9.2 CVSS rating.
• Exploitation is confirmed and ongoing by unidentified threat actors.
• The flaws allow code execution without authentication and can trigger memory exhaustion.
• CISA added the issue to its Known Exploited Vulnerabilities catalog on Monday.
• A patch is available; exposed systems need immediate remediation.

On Monday, CISA placed a PHP2Shell security issue on its list of flaws known to be exploited in the wild. This entry addresses two vulnerabilities, identified as CVE-2026-109618, that carry a CVSS score of 9.2. According to the advisory context, unidentified attackers are already using the flaws, and a fix has been released recently.

The more serious impact is remote code execution that does not require authentication, meaning an attacker could run commands on a vulnerable host without first logging in. The same flaw set can also drive an out-of-memory condition, which may destabilize services or mask intrusion activity behind crashes. Because PHP2Shell is a PHP-related component, any web-facing deployment that has not been updated should be considered exposed.

For K-12 districts and government teams, the risk is not theoretical. Internet-facing applications are common, and a 9.2-rated bug with public exploitation can be weaponized quickly. The KEV listing signals that federal remediation timelines now apply and that defenders should prioritize this over routine patching. Even isolated instances can become initial access points for broader network compromise.

What to watch: unexpected process creation, web server crashes tied to memory exhaustion, anomalous outbound connections, and new files in web-accessible directories. Administrators should verify patch levels, restrict access to PHP2Shell endpoints, and review logs for probing or exploitation attempts. If compromise is suspected, isolate the host, preserve evidence, and begin incident response rather than simply rebooting.

What to do now

1. Inventory every PHP2Shell instance, including internet-facing and internal deployments, and confirm which versions are affected.
2. Apply the vendor patch immediately; if patching is delayed, take vulnerable endpoints offline or block access at the perimeter.
3. Add temporary WAF or reverse-proxy rules to block exploit patterns and restrict PHP2Shell administrative paths to trusted networks.
4. Hunt logs for code-execution attempts, memory-exhaustion crashes, suspicious child processes, and newly written web files.
5. Check CISA KEV remediation deadlines and document completion for compliance reporting.
6. Rotate credentials and secrets on any host that shows signs of compromise, and review scheduled tasks and services for persistence.
7. If exploitation is confirmed, isolate affected systems, preserve forensic evidence, and notify your security team or incident response provider.

CVE references

• CVE-2026-109618

Original source

The Hacker News