CISA Confirms Exploitation of PHP Vulnerabilities
US cyber authorities add two PHP2Shell vulnerabilities to their known-exploited catalogue, increasing urgency for patching vulnerable web systems.
A critical software vulnerability becomes a different kind of risk once attackers are exploiting it outside controlled demonstrations. Two recently disclosed PHP flaws have crossed that threshold.
What happened
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities catalogue on 26 October. The vulnerabilities had been patched days earlier, following disclosures and demonstrations of potential remote code execution.
The agency gave affected US federal civilian organisations a 29 October remediation deadline. Its designation means exploitation has been observed, but does not identify every affected victim or prove that any particular website has been compromised.
PHP underpins many web applications and content-management environments. Exposure depends on the specific configuration and affected software version; operators need to assess their actual deployments rather than assume all PHP sites have been breached.
Why it matters
A flaw can move rapidly from a technical advisory to an operational threat when attackers find a practical exploitation route. Organisations with older systems, limited asset inventories or delayed patching processes may be especially exposed.
The episode also shows why early exploitability assessments can change as further testing reveals working attack conditions. Defenders need a process for updating priorities based on evidence of real attacks, not only severity scores.
The bigger picture
Open-source components are fundamental to the internet, but securing them depends on patch deployment across a huge and uneven ecosystem. Confirmed exploitation reinforces the value of asset discovery, timely updates and incident detection.