# CISA Flags Two Actively Exploited PHP2Shell Flaws That Allow Remote Takeover of Web Servers

*Tuesday, October 27, 2026 at 6:16 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-27T06:16:37.738Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 9/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21682.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: U.S. cybersecurity officials have added two PHP2Shell vulnerabilities to their list of actively exploited software flaws, warning that attackers can gain remote control of affected PHP installations. The decision puts fresh pressure on agencies and companies worldwide to find and patch exposed web servers that support government sites and online businesses.

Two newly highlighted software flaws in PHP, one of the most widely used web programming environments, have moved into the category of confirmed active threats.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says two PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are being exploited in real-world attacks. CISA has added them to its Known Exploited Vulnerabilities catalog, a list that U.S. federal civilian agencies are required to remediate and that many private defenders treat as a de facto emergency patch list.

Both flaws allow unauthenticated remote code execution on vulnerable PHP deployments. In practical terms, an attacker who can reach an exposed web server may be able to run commands on that server without any login. Because PHP underpins a large share of websites and web applications, vulnerabilities in this layer offer attackers a straightforward way to compromise many different organizations at once.

For administrators of public-facing web servers, the risk is immediate. Systems that have not been patched could already be under the control of intruders, without clear outward symptoms. Remote code execution can be used to steal data, deploy ransomware, move deeper into internal networks, or conscript servers into botnets used to launch further attacks.

CISA’s move to list CVE-2026-109618 and CVE-2026-109619 as known exploited issues signals that these are no longer theoretical weaknesses. When a vulnerability enters the KEV catalog, U.S. civilian agencies must apply fixes or other mitigations within a set timeframe, and security teams elsewhere often follow the same schedule. The listing also tells incident responders to search specifically for traces of these exploits in server logs and monitoring tools.

Attackers often favor this style of broad, internet-facing vulnerability. Rather than singling out a specific target at first, they scan for systems running vulnerable software, automate exploitation, and only later decide how to use the access they’ve gained. That approach can expose organizations of every size, from large enterprises to small businesses that rely on hosting providers.

In the near term, defenders are likely to focus on finding where vulnerable PHP2Shell components are deployed, applying vendor updates or temporary workarounds, and checking potentially exposed servers for signs of compromise before patches were installed. Outside observers will be watching whether most exploitation appears tied to financially motivated activity such as ransomware or whether evidence emerges of more targeted campaigns against government or critical infrastructure networks built on PHP-based systems.