CISA confirms PHP2Shell under attack as researchers clock successful exploits

Attacks are confirmed

CISA added two bugs, CVE-2026-109618 and CVE-2026-109619, to its list of known exploited vulnerabilities on Monday. Both are called PHP2Shell. They let attackers run their own code on vulnerable PHP servers without logging in. Federal civilian agencies must fix them by October 29.

Key facts

• Both bugs have a severity score of 9.2 out of 10 on the CVSS scale.
• AWS saw attempts to exploit the flaws on October 17, four days before they were made public.
• Patches came out on October 21.
• One researcher recorded 35 successful shell takeovers across three test servers on October 24.
• Delft University's lab tracked more than 50,000 exploit attempts from over 600 IP addresses in 70 countries. About 171 of those addresses sent real exploit code or malware.

Why PHP matters

PHP is a language that powers a large part of the web. A serious bug in it can expose many sites at once. Some earlier reports of successful attacks were later corrected. Sophos said its activity was only scanning and failed tries. Palo Alto Networks withdrew a claim that linked the flaws to a break-in at a European government agency.

Why it matters

Many websites may still run old, unsafe versions of PHP. Attackers are trying hard to get in, so website owners need to update quickly. CISA has not said which groups were hacked, so the true number of breaches is still unknown.

What to watch

• Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your version line.
• Old, unsupported PHP versions may need a full upgrade.
• Watch for news of which organizations were breached.
• Federal agencies must finish fixes by October 29. Other groups are urged, but not required, to act.