CISA adds the two critical PHP flaws to its catalogue of exploited vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday 26 October added PHP flaws CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, to its catalogue of actively exploited vulnerabilities, according to The Register and Security Affairs. Federal civilian agencies have until 29 October to apply the patches.

Both flaws have a CVSS severity score of 9.2 and allow code to be executed on PHP servers without authentication, according to The Register. PHP released the patches on 21 October; The Register says users must update to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch.

According to The Register, researcher Adel Karimi recorded 35 successful command executions on three honeypot servers on 24 October, from two IP addresses, and the Delft University of Technology's threat intelligence lab counted more than 50,000 exploitation requests from more than 600 IP addresses in 70 countries, of which 171 sent attack code. Karimi cautioned that his honeypot servers had a configuration favourable to the attack.

Story under review: CISA has not identified any compromised organisations or how many real systems have been affected. Sophos corrected its initial assessment and says it only saw scans and failed attempts, and Palo Alto Networks withdrew its linking of these flaws to the intrusion at a European government agency, according to The Register.