CISA Warns PHP2Shell Flaws Are Under Active Attack, Allowing Remote Code Execution on PHP Servers
The U.S. Cybersecurity and Infrastructure Security Agency has added two actively exploited PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming they allow unauthenticated remote code execution on affected PHP deployments.
Two newly listed software bugs are turning some ordinary PHP installations into entry points for attackers, according to U.S. cyber authorities.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. CISA confirmed that the flaws enable unauthenticated remote code execution on affected PHP deployments, letting an attacker run commands on a vulnerable server without valid login details.
PHP underpins a large share of dynamic websites and online applications. When a component such as PHP2Shell is vulnerable, it can open a path into that environment. Once on the system, attackers can install web shells, move deeper into a network, steal data or conscript the server into broader campaigns.
For system administrators, the inclusion of these CVEs in CISA’s exploited list signals that attackers are already using them in real-world intrusions rather than just testing them in research settings. Servers that look normal from the outside may already have hidden backdoors if the flaws were exploited before patches were applied.
Hosting providers and organisations that operate many PHP-backed sites face the added challenge of finding every exposed instance. A single overlooked deployment can give an attacker a foothold.
Ordinary users may not see any visible sign when a site is compromised through PHP2Shell issues. The impact shows up later if that compromised site starts leaking personal data, distributing malware or participating in larger attacks.
CISA’s Known Exploited Vulnerabilities catalog is widely used by government agencies and private companies to decide what to patch first. Adding the PHP2Shell bugs to that list will push operators of critical systems and public-facing services to move these fixes up their queue.
In the near term, signs of how serious the wave of attacks is becoming will include more public exploit code, spikes in scanning for vulnerable PHP setups, and incident reports from security firms and hosting companies tying intrusions to CVE-2026-109618 and CVE-2026-109619.
Sources
- OSINT