The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.
Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.
The PHP security team patched the two flaws on Wednesday, October 21, one day after urging security teams to install the security updates as soon as they became available.
Although details on the PHP2Shell security flaws (including the CVE IDs and mitigation measures shared with critical infrastructure providers) leaked and some proof-of-concept (PoC) exploits were published online before patches went live, the PHP security team said that none were functional.
Multiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them as unsuccessful.
Amazon Threat Intelligence security researchers also said that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released.
Federal agencies ordered to patch by Thursday
CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Thursday, as mandated by Binding Operational Directive 26-04.
"These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise," the cybersecurity agency warned.
"While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."
While CISA has not yet shared further details about ongoing PHP2Shell attacks, Perplexity detection and response lead Adel Karimi first confirmed in-the-wild exploitation over the weekend after their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.
On Friday, the PHP security team also shared mitigation for a new RCE flaw (CVE-2026-115560) with no patch, exploitable when targeting systems "with an unusual combination of configuration and application code."
PHP powers roughly 70% of all websites, with more than 5.1 million PHP hosts exposed online and around 3.8 million instances with at least one port open to attacks, according to VirusTotal estimates.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.