CISA adds the PHP2Shell flaws to its exploited-vulnerabilities catalog and gives agencies until Thursday to patch
The federal listing confirms that both critical PHP bugs are being exploited, less than a week after fixes shipped.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
The US Cybersecurity and Infrastructure Security Agency added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, to its Known Exploited Vulnerabilities catalog on Monday. Federal agencies have been ordered to patch them by Thursday. Unprivileged attackers can use the flaws in high-complexity attacks to achieve remote code execution on unpatched systems. The PHP security team released fixes on October 21, after details of the bugs and some proof-of-concept exploits leaked early. The team said those leaked exploits did not work. According to BleepingComputer, Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack all saw widespread exploitation attempts before disclosure and classed them as unsuccessful, and Amazon researchers said targeting began four days before the patches. Adding the flaws to the catalog makes patching mandatory for federal civilian agencies, and it gives other organizations running PHP an official signal that exploitation is happening. PHP underpins a large share of web servers, and vendors have said network appliances are affected too, so the deadline puts pressure on any administrator who has not yet updated.