CISA Flags Two PHP2Shell Bugs as Actively Exploited Remote Code Execution Flaws
CISA has added two PHP2Shell vulnerabilities, CVE‑2026‑109618 and CVE‑2026‑109619, to its Known Exploited Vulnerabilities catalog after confirming unauthenticated remote code execution on affected PHP deployments.
Two PHP2Shell vulnerabilities are now officially on the U.S. government’s list of actively exploited security flaws, raising the priority for administrators who run PHP‑based web services.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑109618 and CVE‑2026‑109619 to its Known Exploited Vulnerabilities (KEV) catalog after confirming real‑world attacks. Inclusion in the KEV list means CISA has evidence that adversaries are using the bugs, not just testing them in controlled environments.
Both vulnerabilities allow unauthenticated remote code execution on affected PHP deployments. An attacker can send crafted requests to a vulnerable server and run arbitrary commands without logging in.
PHP backs a wide range of websites and web applications. PHP2Shell issues relate to how certain PHP configurations handle input and execute scripts. Unpatched or misconfigured systems can give attackers a foothold that is hard to detect.
CISA’s KEV catalog drives mandatory remediation deadlines for U.S. civilian federal agencies and often shapes patching priorities in the private sector as well.
For everyday users, a successful exploit on a server can lead to data theft, altered content, or the spread of malware, even though the attack doesn’t require any action by visitors to the site.
In the coming days, security teams will be watching for wider use of PHP2Shell exploits in automated attack tools, increases in internet scanning for vulnerable PHP endpoints, and any advisories from major hosting companies about forced patches or configuration changes.
Sources
- OSINT