CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA has officially added two PHP flaws—CVE-2026-109618 and CVE-2026-109619, both dubbed PHP2Shell and rated 9.2 on CVSS—to its Known Exploited Vulnerabilities catalog after confirming real-world attacks. The first stems from an out-of-memory corruption bug, the second from a stale internal request-state issue, and both allow attackers to achieve unauthenticated remote code execution. Researcher Adel Karimi from Perplexity reported honeypot captures on October 24, 2026 showing successful RCE with actual memory leakage rather than just crashes, with exploit payload addresses matching publicly known offsets. Fixes landed on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and US federal agencies must deploy them by October 29, 2026, while Censys estimates over 32.5 million internet-facing PHP services remain unpatched. Dozens of major vendors—including Citrix, F5, SonicWall, QNAP, Synology, Siemens, and WordPress—have issued their own advisories, and the PHP Foundation separately shipped Windows builds addressing a related Brotli decoder flaw, CVE-2026-111497 (aka Broccoli2Shell), which can likewise enable privilege escalation and RCE.