Press play to start listening
The US Cybersecurity and Infrastructure Security Agency (CISA) added two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog on October 26. The flaws were added after the agency received evidence that attackers have exploited the bugs.
PHP is a core programming language that runs nearly 70 percent of all web sites globally. According to estimates from Censys, over 32.5 million active PHP installations currently run vulnerable software versions.
The flaws are collectively called PHP2Shell and assigned a CVSS score of 9.2 each. CVE-2026-109618 involves memory corruption linked to out-of-memory handling, while CVE-2026-109619 involves stale internal request state. Both can let attackers run code remotely on vulnerable web servers without logging in.
The PHP team released fixes on October 21, but attackers have since managed to exploit the vulnerabilities. As Hackread.com reported the updates last week, these flaws affect several PHP configurations, including Apache mod_php, PHP-FPM and php-cgi. The PHP team specifically warned about mod_php, where a malicious request can trigger the flaw before the application processes it.
Successful Attack Reported
Amazon Threat Intelligence reported that attackers began targeting the flaws four days before the patches were released. Other security firms also detected exploitation attempts, although the early attempts they observed were unsuccessful.
That changed on October 24, when Adel Karimi, detection and response lead at Perplexity, reported successful remote code execution against a honeypot running Apache mod_php with PHP 8.4.26.
The response included an 800 KiB decoded cookie dump, indicating memory disclosure during the exploit chain. The test demonstrated a working attack under that particular configuration, not that every vulnerable PHP server could be exploited in the same way.
Hackread.com also reported on NowSecure research that identified 426 Android and iOS apps connecting to servers advertising potentially affected PHP versions. The findings do not establish that all those apps were vulnerable, but they highlight the need to check the server-side software supporting mobile applications.
CISA’s Deadline and Fixes’ Details
CISA gave affected Federal Civilian Executive Branch agencies until October 29 to address PHP2Shell. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Those administrators using older versions should check with their hosting providers or software vendors for available fixes. Several vendors, including WordPress, Drupal, Craft CMS, Citrix, F5 and QNAP, have also issued advisories for products that may be affected.
The PHP team also disclosed a separate potential RCE flaw, CVE-2026-115560, on October 23, recommending that administrators disable session.upload_progress.enabled as a temporary mitigation.
Updated Windows builds released on October 26 also address CVE-2026-111497, a separate Brotli decompression flaw that can affect PHP’s cURL extension when automatic response decompression is enabled.
Expert’s Commentary
William Wright, CEO of Closed Door Security, shared his comments with Hackread.com, saying CISA’s confirmation backed up earlier concerns about the vulnerabilities.
“CISA has now confirmed the fears that were on everyone’s minds,” Wright said, noting that security vendors had previously detected attempts to exploit the flaws against honeypots and servers, although those attempts had reportedly failed to achieve remote code execution.
He warned that smaller websites and services could face greater risks if they remain unpatched.
“While major services were all promptly patched, the question remains about what will happen to smaller, unmaintained sites and services, and to the many instances where PHP is hidden as part of a tech stack supporting services like internal organization portals and CMS’.”
Wright urged organisations to check their own infrastructure as well as systems managed by external providers and partners.
“Organizations need to review their systems ASAP and ensure that they are not silently exposed to unpatched PHP deployments, whether internally or via third parties and partners.”
