CISA confirms PHP2Shell vulnerabilities now exploited in attacks

CISA has placed two critical PHP bugs, jointly nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), on its catalog of flaws being actively abused by attackers. Unauthenticated attackers can chain these high-complexity issues to achieve remote code execution on vulnerable PHP servers. The PHP team released emergency fixes on October 21, but exploit details and PoCs leaked beforehand, and vendors like Cloudflare, Amazon, Hadrian, watchTowr and Patchstack had already spotted mass probing attempts, initially believed unsuccessful. Amazon says real attack activity started four days before the patch, and Perplexity's security team later confirmed genuine in-the-wild RCE against an unpatched PHP 8.4.26/Apache mod_php setup. Under Binding Operational Directive 26-04, CISA is requiring federal civilian agencies to remediate by Thursday, while urging all organizations to prioritize the update given PHP's use on roughly 70% of websites and millions of exposed hosts. Separately, PHP also disclosed mitigation guidance for a still-unpatched RCE bug, CVE-2026-115560, affecting certain nonstandard configurations.