CISA confirms PHP2Shell under attack as researchers clock successful exploits

Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells

The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week.

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild.

Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That's bad news given how much of the web still relies on PHP, and just how many sites could be left exposed.

REG AD

Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed.

REG AD

CISA's confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door.

On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution.

The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi's findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don't necessarily reflect how reliably the exploit works against production servers.

Still, attackers appear to be giving it a good go. Delft University's Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers.

CISA's confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency.

CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached.

For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them.

Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed.

REG AD

And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®