cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

CISA Adds Actively Exploited PHP2Shell Flaws to KEV Catalog

· Original article ↗

Summary

CISA added the actively exploited PHP2Shell flaws to its KEV catalog. Patches are available for PHP 8.2–8.5; a separate Brotli decoder flaw, CVE-2026-111497, also affects PHP Windows builds and other software.

Key points

  • CISA added the recently patched PHP2Shell flaws to its Known Exploited Vulnerabilities catalog, confirming active exploitation.
  • The PHP vulnerabilities are rated 9.2 and enable unauthenticated remote code execution on affected deployments.
  • Perplexity detection and response lead Adel Karimi reported successful RCE against honeypots on October 24, including memory disclosure evidence; he cautioned that the demonstration used a favorable single-worker mod_php setup.
  • Fixes were released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Federal agencies have until October 29, 2026, to apply them.
  • Censys estimates that more than 32.51 million PHP services are still running an affected version.
  • PHP Foundation Windows builds also address CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can lead to privilege escalation and unauthenticated RCE.
  • The Brotli flaw affects specified versions of Brotli and can be reached through PHP’s cURL extension when automatic HTTP response decompression is enabled; this is disabled by default in cURL.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
  • Out-of-bounds write
Severity
CVSS 9.2 for the two PHP2Shell flaws
Affected Versions
  • Brotli 1.0.3 through 1.0.9
  • Brotli 1.1.0
  • Brotli 1.2.0
Exploitation Status
active
Exploit Availability
public_exploit
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article reports active exploitation of PHP flaws enabling unauthenticated remote code execution on affected deployments.

CVE

CVE-2026-111497the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could also result in

People

Adel KarimiDetection and response lead at Perplexity who confirmed successful remote code execution against honeypot systems on October 24, 2026.

Products

Brotli8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could also result in privilege escalation and unauthenticated remote code execution.curl"In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled," the PHP Foundation said. "This is disabled by default in cURL, butPHPThe PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments -

Countries

United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.

Related Articles