CISA warns of actively exploited PHP2Shell bugs that allow unauthenticated remote code execution
The US Cybersecurity and Infrastructure Security Agency has added two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog after confirming attackers are using them to gain unauthenticated remote code execution on vulnerable PHP deployments.
US cybersecurity authorities have moved two PHP2Shell flaws into a high-risk category after confirming they are being used in real-world attacks to compromise servers.
On 27 October, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. Both vulnerabilities affect PHP2Shell components and allow unauthenticated remote code execution on affected PHP deployments.
Remote code execution vulnerabilities let an attacker run commands on a target system. In these cases, no valid login is required, so any exposed server running the vulnerable component can be taken over if it’s reachable from the internet.
Because PHP underpins a large share of web applications, the attack surface for these bugs spans shared hosting environments, corporate web servers, and other PHP-based services. A successful exploit can give intruders a foothold to steal data, deploy ransomware, or move deeper into a network.
CISA’s decision to list CVE-2026-109618 and CVE-2026-109619 signals that organizations should treat them as priorities for patching and mitigation. US federal agencies are formally required to remediate items in the KEV catalog on set timelines, and the listing also serves as guidance for private-sector defenders.
Security teams will now be looking for vendor patches, updated detection rules, and any public exploit code for these vulnerabilities, as well as incident reports linking them to specific intrusion campaigns.
Sources
- OSINT