CISA Adds Exploited PHP Flaws 'PHP2Shell' to Must-Patch List
US federal civilian agencies have until October 29 to patch CVE-2026-109618 and CVE-2026-109619, which CISA says were exploited in real attacks.
CISA has added two PHP vulnerabilities, nicknamed PHP2Shell, to its Known Exploited Vulnerabilities catalog, confirming that both were used in real attacks, according to TechCrunch. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619.
The agency ordered US federal civilian agencies to patch affected systems by October 29. The PHP development team released a security update fixing the vulnerabilities on October 21.
The PHP project recommends that users update to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Researchers at the security firm Kalif found the remote code execution issue behind the flaws, according to the report. Some organizations and large companies temporarily took websites offline to apply the patch.
Earlier audit flagged related flaws
In a 2024 security audit, related vulnerabilities were found but were not fixed because exploitation had not been demonstrated.
Quick answers
Which PHP versions fix the PHP2Shell vulnerabilities?
The PHP project recommends updating to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
What is the CISA patching deadline?
CISA ordered US federal civilian agencies to patch affected systems by October 29.
What are the CVE IDs for PHP2Shell?
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.