Two Actively Exploited PHP2Shell Flaws Let Attackers Run Code on Unprotected Web Servers
U.S. cyber officials have confirmed that two PHP2Shell vulnerabilities, CVE‑2026‑109618 and CVE‑2026‑109619, are under active attack and allow unauthenticated remote code execution on affected PHP deployments.
Two PHP2Shell vulnerabilities in widely used PHP environments are now being actively exploited, exposing unpatched web servers to remote takeover.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws, tracked as CVE‑2026‑109618 and CVE‑2026‑109619, to its Known Exploited Vulnerabilities catalog after confirming real‑world attacks. Both issues enable unauthenticated remote code execution on affected PHP deployments, which means attackers can run commands on a vulnerable server without logging in.
Placement on CISA’s list turns these bugs into urgent items for federal civilian agencies, which face mandatory deadlines to remediate them. The move also serves as a clear signal to private‑sector security teams that attackers are already using these vulnerabilities in the wild.
Reports describe intrusions where malicious PHP requests trigger the vulnerable PHP2Shell components and hand full control of exposed systems to the attacker. Once inside, an adversary can steal data, plant backdoors, or use the compromised server as a launching point into the rest of a network.
Because PHP underpins many websites and applications, including systems that handle sensitive information, the impact of silent exploitation can extend from service outages to data theft and fraud.
Indicators to track now include the release of public proof‑of‑concept exploit code, increases in scanning traffic aimed at PHP2Shell endpoints, and advisories from major hosting providers setting out patch timelines and mitigation steps.
Sources
- OSINT