Cybersecurity

CISA Confirms Active Exploitation of PHP2Shell Flaws

The U.S. Cybersecurity and Infrastructure Security Agency has added two critical PHP vulnerabilities to its active exploitation catalog and directed federal agencies to apply patches.

Radwan AbdulhadiEditor and technology writer

Published: October 27, 2026 · Updated: October 27, 2026 · 3 min read

CISA Confirms Active Exploitation of PHP2Shell Flaws — Image: BleepingComputer

CISA Issues Directive on PHP2Shell

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities, collectively tracked as PHP2Shell, to its catalog of actively exploited security flaws. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch (FCEB) agencies have been ordered to patch their systems.

CISA noted that these types of vulnerabilities serve as frequent attack vectors for malicious cyber actors and present significant risks to the federal enterprise. The agency encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV catalog items.

Nature of the Vulnerabilities

The security issues are tracked as CVE-2026-109618 and CVE-2026-109619. Threat actors without privileges can exploit both flaws in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.

The PHP security team previously addressed these flaws after [The PHP security team patched](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) them on Wednesday, October 21. This followed earlier warnings [urging security teams](https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/) to install upcoming updates as quickly as possible.

Early Exploitation Observations

Although details regarding the vulnerabilities and mitigation measures shared with critical infrastructure providers were [leaked] online and some proof-of-concept exploits appeared prior to the official patch release, the PHP security team indicated those early exploits were non-functional.

Multiple cybersecurity firms including [Cloudflare] detected widespread scanning and exploitation attempts prior to public disclosure, though they similarly tagged the early activity as unsuccessful.

Furthermore, [Amazon] Threat Intelligence security researchers reported that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were officially made available.

In-the-Wild Confirmations

While CISA has not yet released granular details about ongoing PHP2Shell attacks, Perplexity detection and response lead Adel Karimi confirmed in-the-wild exploitation over the weekend. Honeypots recorded concrete evidence of remote code execution targeting an Apache mod_php installation running PHP 8.4.26.

In addition to the PHP2Shell issues, the PHP security team shared mitigations on Friday for a separate RCE flaw tracked as CVE-2026-115560, which currently lacks a direct patch and affects systems running specific combinations of configuration and application code.

Wider Industry Context

PHP remains a foundational technology across the web ecosystem, powering approximately 70% of all websites. VirusTotal estimates indicate that more than 5.1 million PHP hosts are exposed online, with roughly 3.8 million instances maintaining at least one port open to potential attacks.

As organizations work to secure their web infrastructures against active campaigns, security analysts continue to emphasize the importance of prompt patching and rigorous vulnerability management to mitigate severe remote code execution risks.