CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency has added two critical PHP vulnerabilities, jointly known as PHP2Shell, to its Known Exploited Vulnerabilities catalog after confirming real-world exploitation.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers remotely execute code on vulnerable PHP web servers.

CISA added both issues to the KEV catalog on October 26 and urged organizations to treat them as an urgent patching priority. The agency said the vulnerabilities pose significant risk because attackers can target web-facing systems without needing valid login credentials.

Federal Civilian Executive Branch agencies must complete mitigation or take affected products out of service by October 29 under Binding Operational Directive 26-04.

CVE-2026-109618 is described as a PHP memory corruption issue. It occurs when PHP encounters an out-of-memory condition and leaves some internal request data in an unsafe state.

CVE-2026-109619 is a stale internal request-state issue where PHP can retain references to memory that has already been released. Under certain conditions, an attacker can use either weakness to gain remote code execution on an exposed server.

PHP2Shell Vulnerabilities Actively Exploited

The flaws affect PHP deployments used to serve web applications, including systems running PHP through common web server setups.

Security researchers warn that both issues may be especially serious in environments where PHP workers process repeated requests, since attackers may trigger the vulnerable state and then send follow-up requests to gain code execution.

Successful exploitation could allow a threat actor to run commands with the permissions assigned to the PHP web worker. PHP released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations running older supported branches should upgrade to the matching fixed release immediately.

Teams using PHP 5.x, 7.x, or 8.0 and 8.1 should review their hosting platform or operating system vendor guidance because the PHP project no longer maintains those branches.

CISA’s warning matters because inclusion in the KEV catalog means evidence shows attackers are already exploiting the bugs. Security teams should not treat PHP2Shell as a routine software update.

Internet-facing PHP servers should be identified first, then patched and restarted so the updated runtime is loaded. Administrators should also check application logs, web server logs, PHP-FPM logs, process activity, and outbound network connections for unusual behavior that may indicate compromise before the update was applied.

Web application firewalls may reduce some malicious requests, but they don’t replace updating PHP. Organizations should also review third-party products, hosting panels, container images, and cloud workloads that package their own PHP runtime. Vendor-supplied software may need a separate update even when the base operating system has been patched.

Readers can also follow Cyber Security News coverage of CISA security developments and monitor the CISA KEV Catalog for newly exploited flaws. For technical details and patch guidance, administrators should review CISA’s PHP2Shell alert.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns of PHP2Shell Vulnerabilities Actively Exploited in Attacks appeared first on Cyber Security News.