Security1 hOctober 27, 2026, 15:20

CISA confirms PHP2Shell vulnerabilities exploited in attacks

CISA added two critical PHP flaws tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalog. The bugs allow unauthenticated remote code execution, and federal agencies must patch by Thursday.

BleepingComputer

Open source

CISA confirms PHP2Shell vulnerabilities exploited in attacks

CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE on unpatched systems
PHP patched both flaws on October 21 after details leaked
Exploitation began four days before patches; Cloudflare and Amazon logged attempts
PHP powers about 70% of websites, with over 5.1 million hosts exposed online

#PHP#CISA

Vendors and regulators respond to PHP2Shell vulnerabilities

Security

Millions of PHP2Shell exploit attempts, but no confirmed break-ins

Security

Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

Security

CISA confirms PHP2Shell vulnerabilities exploited in attacks

Vendors and regulators respond to PHP2Shell vulnerabilities

Millions of PHP2Shell exploit attempts, but no confirmed break-ins

Sophos and Palo Alto retract PHP2Shell exploitation claims as attacks begin

Mirai botnet joins PHP2Shell attacks as ASLR bypass exploit emerges