CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to remediate both flaws.
CISA's KEV listing and the federal deadline
The U.S. government's cybersecurity watchdog publicly declared both PHP2Shell bugs to be actively exploited, moving from a prior advisory that warned of danger but said it had not observed confirmed exploitation. By listing CVE-2026-109618 and CVE-2026-109619 on the KEV catalog, CISA established a mandatory October 29 remediation date for federal civilian agencies. The agency has not disclosed which organizations have been compromised or supplied technical details behind its decision to add the flaws to KEV, and its listing confirms active exploitation without quantifying how many production systems have been successfully breached.
Technical severity: unauthenticated remote code execution
Both vulnerabilities carry a 9.2 score on the CVSS scale and permit unauthenticated exploitation to execute code on vulnerable PHP servers. That is a notable risk because "how much of the web still relies on PHP" was explicitly cited as a concern in reporting about the flaws. Patches for affected release branches were published on October 21, but attackers had been probing and attacking well before that date.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEvidence of exploitation: honeypots, cloud telemetry, and global scans
Multiple independent data points cited by the reporting show varying levels of attacker activity. Amazon Web Services observed attempts to exploit the flaws as early as October 17 — four days before the vulnerabilities were publicly disclosed.
On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. Those interactions originated from two IP addresses and used memory exhaustion and disclosure techniques to achieve remote code execution. In Karimi's tests attackers attempted outbound contact using PHP, curl, and wget, though no additional malware was successfully downloaded. Karimi noted his findings matched exploitation of CVE-2026-109618 and found no evidence implicating the second PHP2Shell flaw in those specific events; he also warned the honeypots' single-worker configuration may have made exploitation easier than on production servers.
Delft University's Threat Intelligence Lab reported broader scanning and exploitation activity, tracking more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those addresses, 171 moved beyond probing and began sending exploit code or malware droppers.
Earlier public assessments were not uniformly consistent: Sophos later walked back an initial assessment after concluding the observed activity amounted to scanning and failed attempts, and Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. Those revisions preceded CISA's formal addition of the two CVEs to KEV.
Patch guidance, timing, and operational choices
Patches were released on October 21; CISA is urging rapid deployment. The explicit update guidance in reporting instructs administrators to move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. For environments running older, unsupported PHP versions, the options are limited to upgrading to a supported branch or obtaining vendor-supported fixes. The advisory also recommends that systems that cannot be secured be taken offline until the risk is addressed.
The reporting highlights a practical urgency: attackers had observed attempts in the wild prior to public disclosure, and research evidence shows some successful executions. For federal civilian agencies the October 29 KEV deadline is binding; for other organizations, CISA is urging prioritization of fixes even though the deadline does not apply to them.
What this means for federal civilian agencies, non-federal organizations, and PHP maintainers
- Federal civilian agencies: They must meet the October 29 KEV remediation deadline and either apply the published patches or take affected systems offline. CISA's listing makes remediation mandatory for these agencies.
- Non-federal organizations and enterprises: The agency explicitly urged these organizations to prioritize fixes even though the KEV deadline does not apply to them; they will weigh the published patch versions against the complexity of upgrading or obtaining vendor-supported fixes for legacy PHP installations.
- PHP maintainers and site administrators: Patches landed on October 21, but the timeline of AWS telemetry (October 17) and observed honeypot compromises (October 24) underline that attackers may have been exploiting the window between discovery and remediation; maintainers will be focused on pushing fixes, communicating affected versions, and helping customers on unsupported branches.
CISA's formal confirmation removes lingering doubt about active exploitation, but the agency's refusal to name compromised organizations or provide attack specifics leaves a practical question open: how many production systems have been successfully breached? For now the plain instruction is this — apply the stated patches, or take exposed systems offline — because the available telemetry and honeypot data show attackers both probing at scale and scoring successful shells.
Source: The Register — CISA confirms PHP2Shell under attack as researchers clock successful exploits
