The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are exploiting both PHP2Shell vulnerabilities. Federal civilian agencies now have until October 29 to patch PHP servers exposed to the two critical bugs.
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday. A week earlier, the agency had warned about the flaws but said it had not yet seen successful exploitation in the wild. The KEV listing for PHP2Shell reverses that position.
Both vulnerabilities carry a CVSS score of 9.2. An attacker needs no login to use them, and a successful exploit runs code on the target server. Because a large share of the web still runs on PHP, the number of potentially exposed sites is high.
PHP2Shell exploitation began before disclosure
PHP maintainers shipped patches on October 21. However, attackers had a head start. AWS detected exploitation attempts as early as October 17, four days before the bugs became public.
On October 24, Perplexity security researcher Adel Karimi logged 35 successful shell executions across three honeypots. Each ran PHP 8.4.26 under Apache mod_php. The traffic came from two IP addresses and used memory exhaustion and memory disclosure to reach remote code execution.
After gaining a shell, the attackers tried to reach outside servers through PHP, curl and wget. No additional malware downloaded successfully. Karimi tied the PHP2Shell activity to CVE-2026-109618 and found no sign of the second flaw in use.
He also added a caveat. His honeypots used a single-worker configuration that favors the attacker, so the results may not reflect how reliably the exploit works against production servers.
Tens of thousands of requests, some reports retracted
Meanwhile, the Delft University Threat Intelligence Lab has counted more than 50,000 PHP2Shell exploitation requests. They came from over 600 IP addresses in 70 countries. Of those addresses, 171 moved past probing and sent exploit code or malware droppers.
Not every early report held up. Sophos revised its first assessment after concluding the activity it saw was scanning and failed attempts. Palo Alto Networks also withdrew claims that linked the bugs to an intrusion at a European government agency.
CISA has not named any compromised organizations or described the attacks behind the KEV decision. As a result, the listing confirms active exploitation without saying how many production systems were breached.
Which PHP versions fix the flaws
KEV deadlines apply to federal civilian agencies under Binding Operational Directive 22-01, so the October 29 date binds only them. Still, CISA is urging every other organization to prioritize the patches.
Administrators should move to one of these releases, depending on their branch:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Servers on older, unsupported PHP versions need a full upgrade or a vendor-supported fix. For systems that cannot be secured, the guidance is to take them offline until a fix is in place.
Teams that patched after October 17 may also want to review logs from that window. AWS saw exploitation attempts four days before disclosure, so servers that were updated promptly could still have been probed or hit before the patch existed.