CISA flags two critical PHP flaws as attackers gain remote shells

Key points

• Two critical PHP vulnerabilities are being exploited in the wild.
• CISA added both flaws to its known-exploited list on October 27, 2026.
• Researchers demonstrated functional remote shells against affected systems.
• Successful attacks can give intruders interactive command execution.

CISA has confirmed real-world attacks involving a pair of critical PHP vulnerabilities and placed both on its catalog of flaws known to be exploited. The action, dated October 27, 2026, signals that the issues are no longer theoretical: researchers have shown that affected installations can be made to yield functioning command shells, giving an intruder interactive control over a compromised server.

The exposure matters because PHP underpins a large share of web applications and administrative tooling, including systems operated by school districts and government agencies. A flaw that permits remote shell access can let an attacker run commands, pivot to other systems, and manipulate data well beyond the original application. Organizations that expose PHP-based services to the internet should treat this as an urgent patching and hunting problem.

The confirmed attacks and the public shell demonstrations raise the likelihood that other actors will attempt similar exploitation. CISA's listing is intended to drive prioritization, but it does not replace local action. Districts should determine where PHP is running, which instances are reachable from untrusted networks, and whether vendor fixes or mitigations are available for the two flaws.

What to watch: updated PHP and vendor guidance, signs of unexpected command execution on web servers, and any new scanning or exploitation attempts against exposed endpoints. Because the flaws are already being used in attacks, delay increases risk. Teams should patch or mitigate first, then verify that no shell activity or persistence remains.

What to do now

1. Inventory every PHP installation, including internet-facing web apps, internal tools, and forgotten test systems; record versions and owners.
2. Apply available PHP or vendor patches for both critical flaws immediately; where no fix exists, disable affected components or restrict access.
3. Place PHP services behind a web application firewall and block direct access to management endpoints from untrusted networks.
4. Hunt web-server and system logs for command execution, unexpected child processes, webshell artifacts, and unusual outbound connections.
5. Isolate any host suspected of shell access, rotate secrets and credentials, and rebuild from trusted images before returning it to service.
6. Monitor CISA and PHP advisories for updates, and rescan the environment after patching to confirm exposure is closed.

Original source

The Register — Security