CISA Adds PHP2Shell Flaws to Exploited Vulnerabilities Catalog; Honeypots Record RCE
Summary
CISA added the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch. A researcher reported honeypot evidence of RCE; earlier attempts were reported unsuccessful.
Key points
- CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, can allow unprivileged attackers to achieve remote code execution on unpatched systems through high-complexity attacks.
- The PHP security team released patches on October 21. It said leaked details and proof-of-concept exploits published before release were not functional.
- CISA added the flaws to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to secure affected systems by Thursday under BOD 26-04.
- Perplexity detection and response lead Adel Karimi reported honeypot evidence of in-the-wild RCE against Apache mod_php running PHP 8.4.26.
- Several security firms reported widespread exploitation attempts before public disclosure but classified them as unsuccessful; Amazon researchers said targeting began four days before patches were released.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Affected Versions
- PHP 8.4.26 (version observed on an Apache mod_php installation where exploitation was recorded)
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
CVE
CVE-2026-109618Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.CVE-2026-109619Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems.CVE-2026-115560On Friday, the PHP security team also shared mitigation for a new RCE flaw (CVE-2026-115560) with no patch, exploitable when targeting systems "with an unusual combination of configuration and application code."
People
Vendors
AmazonMultiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them asCloudflareMultiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them asHadrianMultiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them asPatchstackMultiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them asPerplexityWhile CISA has not yet shared further details about ongoing PHP2Shell attacks, Perplexity detection and response lead Adel Karimi first confirmed in-the-wild exploitation over the weekend after their honeypots recordedPrevidianMultiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them aswatchTowRMultiple cybersecurity firms (including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack) also detected widespread exploitation attempts before public disclosure, but they all tagged them as
Products
Apache mod_phpover the weekend after their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.PHPCybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws.