CISA’s action and the federal deadline
The U.S. Cybersecurity and Infrastructure Security Agency added the PHP2Shell flaws to its catalog of actively exploited security issues and invoked Binding Operational Directive 26-04, ordering Federal Civilian Executive Branch (FCEB) agencies to patch by Thursday. CISA warned that, "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise," and urged broader adoption of the guidance: "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."
What the vulnerabilities do and when patches arrived
The two vulnerabilities — tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell — allow unauthenticated attackers to achieve remote code execution (RCE) on unpatched systems. The PHP security team released patches for both flaws on Wednesday, October 21, one day after urging security teams to install updates "as soon as they became available." The team also shared mitigation details for a separate RCE flaw, CVE-2026-115560, for which no patch yet exists and which is exploitable only against systems "with an unusual combination of configuration and application code."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDetection, exploit attempts, and public disclosure
Multiple cybersecurity firms reported widespread exploitation attempts before public disclosure but classified their detections as unsuccessful. Firms named in reporting include Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack. Amazon Threat Intelligence researchers indicated that attackers began targeting the PHP2Shell vulnerabilities four days before the security patches were released. Proof-of-concept (PoC) exploits and some leaked details circulated before the patches went live; however, the PHP security team said that none of the published PoCs were functional.
Confirmed in-the-wild execution and affected configurations
Perplexity detection and response lead Adel Karimi reported the first confirmation of in-the-wild exploitation over the weekend after honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26. That confirmation, combined with the industry detections, indicates attackers were actively probing for vulnerable PHP hosts before and immediately after patches were published.
What this means for technologists, federal agencies, and enterprises
- Technologists and security teams: Prioritize patch deployment for PHP hosts and verify configurations used in production, especially Apache mod_php instances running PHP 8.4.26, and review mitigations for CVE-2026-115560 where a patch is not yet available.
- Federal agencies and policymakers: Meet the Binding Operational Directive 26-04 deadline and confirm remediations are applied across the estate; CISA’s KEV Catalog addition carries a near-term compliance requirement for FCEB agencies and an explicit warning about the risks to the federal enterprise.
- Enterprises and procurement leaders: Note that PHP powers roughly 70% of websites and that VirusTotal estimates there are more than 5.1 million PHP hosts exposed online, with around 3.8 million instances having at least one port open to attacks — a large exposed population that increases the chance of post-compromise activity even when initial prevention appears effective.
Industry reporting also underscores a recurrent reality: prevention metrics can look strong until an attacker obtains valid credentials or executes code. As the Blue Report 2026 notes, "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply," a point reinforced by metrics gathered across 338 million simulations in customer production environments.
The facts are straightforward: two critical PHP flaws were patched on October 21, exploitation attempts were observed both before and after disclosures, and the U.S. federal enterprise has been ordered to remediate immediately. The open questions left by these facts are operational — how quickly patches are verified across millions of exposed hosts, how many previously unsuccessful probes become effective as weaponized code evolves, and whether the unpatched CVE-2026-115560 will see functional exploits. For now, the calendar is set: patches exist and a federal deadline is in place; the immediate priority for defenders is to apply and verify those fixes.
Original reporting: CISA confirms PHP2Shell vulnerabilities now exploited in attacks — BleepingComputer
