"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Adel Karimi, detection and response lead at Perplexity, said after running exploit checks against honeypots on October 24, 2026.
CISA adds CVE-2026-109618 and CVE-2026-109619 to the KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of two recently patched PHP vulnerabilities by adding them to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws are rated 9.2 on the CVSS scale and enable unauthenticated remote code execution. They are identified as CVE-2026-109618, described as an out-of-memory corruption that enables unauthenticated remote code execution, and CVE-2026-109619, described as a stale internal request-state vulnerability that likewise enables unauthenticated remote code execution.
Perplexity honeypots: October 24 evidence of usable RCE
Perplexity's detection and response lead, Adel Karimi, reported successful instances of remote code execution against honeypot systems on October 24, 2026. Karimi described the exploit results as delivering “an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload.” He also cautioned the demonstration ran on an “intentionally favorable single-worker mod_php profile,” and that the test does not measure exploit reliability across other worker counts, PHP builds, or applications.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPatched PHP releases, federal deadline, and Brotli/Broccoli2Shell follow-up
PHP releases addressing the two PHP2Shell flaws were published on October 21, 2026: PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA set a remediation timeline for federal agencies, giving them until October 29, 2026, to apply the necessary fixes.
Separately, the PHP Foundation released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 as of October 26, 2026, to address CVE-2026-111497 — an out-of-bounds write vulnerability in the Brotli decoder library that can result in privilege escalation and unauthenticated remote code execution. That weakness has been discussed under names including Broccoli2Shell, HTTP2Shell, and Node2Shell.
The Brotli decoder vulnerability affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 and has been patched in versions 1.0.10, 1.1.1, and 1.2.1. The PHP Foundation noted the vulnerable decoder in PHP Windows builds can be reached through the cURL extension when automatic HTTP response decompression is enabled; this feature is disabled by default in cURL, but applications and HTTP client libraries can enable it. Projects that include the C library — including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python — are among the projects that incorporate the fixed Brotli code.
Vendor and agency advisories rolled out
The severity of the PHP2Shell and related Brotli issues prompted advisories from a broad list of vendors and agencies. Named entities that issued notices include:
- ABB
- Arista Networks
- Belden
- Broadcom
- Canon
- Citrix
- Dell
- Dormakaba
- F5
- Hikvision
- HP
- HPE
- Hitachi Energy
- HMS Networks
- Huawei
- IBM
- Ivanti
- Johnson Controls
- Mitel
- Moxa
- NETGEAR
- Okta
- QNAP
- Rockwell Automation
- Ruckus Wireless
- Salesforce
- Schneider Electric
- Siemens (1), (2)
- SonicWall
- Splunk
- Synology
- Veeam
- Wibu-Systems
- WordPress
What this means for federal agencies, technologists, and affected vendors
- Federal agencies — The KEV listing and CISA's remediation timeline give agencies until October 29, 2026, to apply the PHP fixes; agencies will be operating under that explicit deadline to mitigate confirmed active exploitation tied to CVE-2026-109618 and CVE-2026-109619.
- Technologists and security teams — The Perplexity confirmation of usable remote code execution, including an 800 KiB decoded cookie dump and a function address used in a payload, raises the exploit from theoretical to observed; teams should prioritize applying the October 21 PHP patches and evaluate whether any application configurations (for example, cURL automatic decompression on Windows builds) expose the Brotli decoder vulnerability.
- Affected vendors and enterprises — According to estimates shared by Censys, more than 32.51 million PHP services are still running an affected version; vendors that package PHP or include Brotli in their products should track the vendor advisories listed above and verify they have integrated the patched Brotli libraries (1.0.10, 1.1.1, 1.2.1) where relevant.
The combination of a KEV listing, public exploit evidence from October 24, and a close federal remediation deadline compresses the window for action: patches were issued on October 21 and Windows builds addressing the Brotli issue arrived October 26, and federal agencies must act by October 29, 2026. Organizations that host or package PHP or that depend on Brotli-decoding components will need to reconcile those timelines with the Censys estimate that tens of millions of PHP services remain on affected versions.
