On October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both PHP2Shell flaws to its Known Exploited Vulnerabilities catalog, confirming that attackers are actively exploiting them in the wild. The listing covers CVE-2026-109618 and CVE-2026-109619, two critical flaws rated 9.2 that allow unauthenticated remote code execution on unpatched PHP servers. According to BleepingComputer, the confirmation rests on honeypot evidence from Perplexity detection lead Adel Karimi, who recorded working remote code execution against an Apache server running PHP 8.4.26. Federal agencies must patch by October 29, and CISA’s listing turns a week of scanning and failed attempts into an official exploitation verdict.
What The KEV Listing Requires
CISA’s October 26 alert names both flaws for its catalog: CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability. CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Under Binding Operational Directive 26-04, federal civilian agencies must prioritise rapid remediation of catalogued flaws on publicly exposed assets. The listing sets October 29 as the remediation deadline for the two PHP flaws. CISA encourages every other organisation to treat catalogued flaws the same way, even though the directive itself binds only federal civilian agencies.
The fixes are already available. The PHP project released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, and updating to one of those releases, then restarting every PHP worker, is the only complete fix. CISA had already shared a SIGMA detection rule for PHP2Shell exploitation attempts on October 23, giving defenders a way to hunt for attacks in their logs.
Confirmed Exploits Replace Weeks Of Failed Attempts
Until October 24, the evidence pointed only to probing. Security firms including Cloudflare, watchTowr, Patchstack and Hadrian had logged exploitation attempts, but flagged them all as unsuccessful. Amazon Threat Intelligence had spotted attackers targeting the flaws as early as October 17, four days before the patches shipped, yet nothing had shown a working compromise.
Karimi’s honeypots changed that picture. According to BleepingComputer, his honeypot farm recorded confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26, the release just before the fixed 8.4.27. Karimi said the response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump appeared in the subsequent execution payload. Expel threat researcher Marcus Hutchins, who had been tracking a stream of alleged successful attacks, called it the highest-quality confirmation of in-the-wild PHP2Shell exploitation he had seen so far.
Karimi himself set the limit on what the evidence proves. He said the chain was demonstrated on an intentionally favourable single-worker mod_php profile, and it is not a measurement of exploit reliability on other worker counts, PHP builds or applications. That caveat matters, but it does not soften the verdict: exploitation is real, and it is no longer theoretical.
The exposure behind the listing is enormous. Censys estimates put more than 32.51 million PHP services still running an affected version, and PHP powers roughly 70 percent of websites. A flaw in the interpreter itself, rather than in any one application, leaves even a fully updated WordPress, Drupal or Laravel site exposed while its PHP version stays unpatched.
Why It Matters
The KEV listing is the moment PHP2Shell stops being a patching scramble and becomes a confirmed compromise risk. Federal agencies now face a hard deadline, and every other operator gets the same signal: unpatched internet-facing PHP servers are active targets, not hypothetical ones. Patching late is no longer a scheduling choice, because attackers have already shown they can turn the flaws into a working shell.
Operators should also look backwards, not just forwards. Because exploitation attempts began before disclosure, logs for internet-facing PHP hosts deserve a review reaching back to at least October 17, before evidence rotates out. A successful exploit can return a normal HTTP response and leave application logs clean, so the hunt must focus on what follows an attack, such as PHP workers spawning shells. The KEV listing does not cover a separate PHP flaw left without an emergency fix, which still needs its own mitigation.
Background
The PHP2Shell flaws were first disclosed on October 21, after vulnerability details and proof-of-concept material leaked online a day earlier and forced the PHP project to publish its coordinated release ahead of schedule. The disclosure triggered a mass-exploitation wave that followed, with governments and companies rushing to patch and some taking sites offline, before researchers separated genuine compromises from the noise of failed attempts. CISA’s catalog listing closes that argument: the flaws are exploited, the deadline is October 29, and the patch window is now measured in days.
Source: CISA: “CISA KEV PHP2Shell listing”; BleepingComputer: “BleepingComputer PHP2Shell report”
0 Comments