CISA Flags Two Exploited PHP Flaws, Urges Emergency Patching

En bref

• CISA confirmed active exploitation of two PHP-related CVEs.
• The flaws affect PHP and PHP2Shell deployments.
• Emergency vendor updates were published on October 21.
• Internet-facing and third-party PHP applications should be prioritized.

On October 21, CISA entered a pair of PHP-related security bugs into its Known Exploited Vulnerabilities catalog after determining that attackers are already using them. The two identifiers are CVE-2026-109618 and CVE-2026-109619. Emergency fixes were published for PHP and PHP2Shell, and both issues are rated as severe. The action signals that this is not merely a theoretical patch cycle: exploitation has been observed.

Organizations running PHP or PHP2Shell are in scope, including schools, district web portals, internal applications, and third-party services that bundle the software. K-12 environments often rely on PHP-based learning tools, forms, and content systems, so exposure may extend beyond centrally managed servers. Any internet-facing instance deserves immediate attention, but internal systems should not be ignored because attackers frequently pivot after initial access.

The KEV listing matters because it confirms real-world abuse and typically triggers aggressive remediation timelines for federal agencies. Even where those deadlines do not formally apply, the same urgency is warranted for state and local education agencies. A critical flaw in a widely deployed runtime can be exploited at scale, and delayed patching leaves a known entry point open to automated scanning and follow-on attacks.

PHP remains common across web applications, and the involvement of PHP2Shell broadens the set of components that administrators must check. Because two CVEs are involved, teams should not assume that applying one update resolves the risk. Verify versions after patching, restart affected services, and confirm that container images and vendor-supplied appliances are also updated rather than only the host installation.

What to watch: vendor advisories for fixed releases, exploitation attempts in web and application logs, unexpected PHP process behavior, and any third-party product that embeds PHP or PHP2Shell. Prioritize internet-facing services, restrict administrative interfaces, and maintain a short remediation window until all exposed instances are confirmed patched.

À faire maintenant

1. Inventory every PHP and PHP2Shell instance, including containers, appliances, and third-party applications that bundle the software.
2. Apply the emergency vendor updates for CVE-2026-109618 and CVE-2026-109619 immediately, starting with internet-facing systems.
3. Verify installed versions and restart affected services; remove or isolate end-of-life deployments that cannot be patched.
4. Review web and application logs for exploitation attempts, unusual PHP process activity, and signs of compromise; isolate suspicious hosts.
5. Restrict PHP2Shell endpoints and administrative interfaces to trusted networks, using WAF rules only as a temporary compensating control.
6. Track CISA KEV and vendor advisories, assign a firm remediation deadline, and report completion through normal IT governance channels.
7. Confirm backups and incident-response contacts are current before widespread patching begins.

Références CVE

• CVE-2026-109618
• CVE-2026-109619

Source originale

Security Affairs