Critical PHP2Shell: two unauthenticated RCE flaws in PHP itself. Fixes shipped on 21 Oct 2026. Check if you are affected →
日本語 Contact
← All news

CISA Adds PHP2Shell to Its Known Exploited Vulnerabilities Catalog, With a 29 October Deadline for US Agencies

On 26 October 2026 CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV catalog. US federal civilian agencies must patch and perform forensic triage by 29 October, and CISA says everyone else should treat it as a priority too.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog. The entries are dated 26 October 2026, and CISA updated its PHP2Shell alert the same day to reflect the change.

A KEV listing means CISA now has evidence that the flaws are being exploited in the wild. When CISA updated the alert on 23 October, it said it had not yet observed successful exploitation. Over the weekend, honeypot data showed attackers getting working shells on PHP 8.4.26 running under Apache mod_php.

What the KEV entries say

  • CVE-2026-109618: "PHP Memory Corruption Vulnerability", an out-of-memory corruption flaw that allows unauthenticated remote code execution.
  • CVE-2026-109619: "PHP Stale Internal Request-State Vulnerability", which also allows unauthenticated remote code execution.
  • Date added: 26 October 2026. Due date: 29 October 2026.
  • Forensic triage required per BOD 26-04: Yes. Agencies are expected to look for signs of compromise, not just install the patch.
  • Known to be used in ransomware campaigns: Unknown.

The three-day window applies to US federal civilian agencies under Binding Operational Directive 26-04. It's not legally binding on private companies, but CISA says every organization should use the KEV catalog to decide what to patch first.

What to do

CISA's guidance hasn't changed:

  1. Find every PHP install. That includes PHP bundled inside appliances and vendor products, where it's easy to miss.
  2. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, starting with internet-facing systems. All PHP setups that serve web requests are affected, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
  3. Take systems offline if you can't patch them, especially anything still on PHP 8.1 or older, which upstream PHP doesn't fix.
  4. Treat a WAF as a stopgap. It might buy you time, but it doesn't replace the update.
  5. Watch for PHP worker processes that launch shells or download tools. CISA's SIGMA rule can help you search for this.

Because the KEV entry calls for forensic triage, sites that were exposed before they were patched should also check for web shells, new admin accounts and odd outbound connections. Getting onto a fixed version doesn't tell you whether someone got in before you did.

If you're running an end-of-life PHP release that can't move to a supported branch quickly, RescuePHP can help with backported fixes, upgrade planning and checking for compromise after patching.