CISA Warns of Active PHP2Shell Exploits That Allow Unauthenticated Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency has added two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog after confirming active attacks that enable unauthenticated remote code execution.
Two newly highlighted vulnerabilities in PHP deployments are now confirmed to be under active attack, putting many web servers at risk of full compromise.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said it has added two PHP2Shell-related vulnerabilities—CVE-2026-109618 and CVE-2026-109619—to its Known Exploited Vulnerabilities (KEV) catalog, after confirming that attackers are already exploiting them in real-world conditions.
Both flaws allow unauthenticated remote code execution on affected PHP installations. An attacker who finds a vulnerable server can run arbitrary commands without any login, which can lead to complete control of the system. That access can then be used to steal data, deploy ransomware, move deeper into corporate networks, or plant backdoors.
Organizations that use PHP-based websites, content management systems, or custom business applications face a direct threat, especially if their PHP servers are exposed to the internet. Systems that handle customer logins, payments, or internal portals become attractive targets for attackers seeking databases or launchpads for further intrusions.
By placing CVE-2026-109618 and CVE-2026-109619 in the KEV catalog, CISA has effectively made mitigation mandatory for U.S. federal civilian agencies within set deadlines. The listing signals to vendors, hosting providers, and enterprises that these are actively abused vulnerabilities that require prompt patching or other defenses rather than routine, low-priority fixes.
The PHP2Shell issues highlight a broader problem of widely used web components running for long periods without thorough updates, leaving a large exposed surface. Once a remote code execution flaw in such a common technology becomes weaponized, attackers can automate internet-wide scans for vulnerable systems and quickly scale up exploitation.
Important indicators to watch now include the speed at which hosting providers and software platforms distribute patches or mitigation guidance, more detailed technical information on which PHP configurations are most exposed, and incident reports tying these CVEs to confirmed breaches, particularly in critical infrastructure or large organizations.
Sources
- OSINT