CISA Adds Two PHP2Shell Flaws to Exploited-Vulnerabilities List, Sets Oct. 29 Federal Patch Deadline

Since PHP shipped fixes on Oct. 21 for the two critical flaws known as PHP2Shell, the question has been whether anyone could actually turn them into working attacks. As of Monday, Oct. 26, the federal government says someone has.

The Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog that day. Both carry a 9.2 severity score and allow unauthenticated remote code execution. Federal civilian agencies have until Oct. 29 to apply the patches.

What changed since last week

The trigger was a technical write-up from Adel Karimi, detection and response lead at Perplexity. His honeypots recorded confirmed remote code execution on Oct. 24 against an Apache mod_php installation running PHP 8.4.26.

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said. The response carried an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets showed up in the execution payload that followed.

Marcus Hutchins, a threat researcher at Expel, called it "by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far."

Karimi was careful about scope. The evidence covers "the intentionally favorable single-worker mod_php profile," he said, and "is not a measurement of exploit reliability on other worker counts, PHP builds, or applications."

Disputed record on earlier exploitation

The picture before Oct. 24 was murkier. Technical details and proof-of-concept code leaked on Oct. 20, which led PHP to pull its patch release forward one day to Oct. 21. The PHP security team said none of the public exploits circulating at that point were functional.

Cloudflare, Hadrian, watchTowr, Previdian and Patchstack all detected exploitation attempts before disclosure and flagged them as unsuccessful. Amazon Threat Intelligence saw attackers targeting the flaws beginning Oct. 17, four days before the patches. Dataminr's TRACE team said that until Karimi's findings, the activity was limited to scanning, fingerprinting and non-working exploits, with no known compromises.

Tenable's running FAQ adds a competing data point. It cites a Trail of Bits report of working exploits against pre-patch PHP releases. That sits awkwardly with PHP's early statement that no public exploit worked.

The flaws and the fix

CVE-2026-109618 stems from out-of-memory handling that leaves request data half-built while cleanup code trusts it. CVE-2026-109619 is a use-after-free, in which a later request on the same worker reuses freed request data.

CISA says the flaws affect all PHP installations serving web requests: Apache with mod_php, which PHP itself considers highest risk, plus PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

PHP 8.1 and older receive no patch. CISA tells organizations that cannot update, or that still run 8.1 or earlier, to take PHP-based systems offline until they can. A web application firewall "may provide some protection," the agency said.

The agency also tells defenders to inventory PHP everywhere, since it is often buried inside other software, and to patch internet-facing systems first. It also wants monitoring for PHP worker processes launching shells or downloading tools. CISA published a SIGMA detection rule on Friday, Oct. 23.

Defense contractor adviser ISI, which serves defense industrial base firms, recommends hunting back to Oct. 17 even on systems already patched.

How big the exposed footprint is

PHP runs on an estimated 70% of websites. Censys estimates more than 32.51 million PHP services still run an affected version. The patch rollout has also hit friction: Tenable's FAQ notes a regression in PHP 8.4.27 and 8.5.12 and advises restarting PHP services after updating. The FAQ does not detail the regression in the excerpt available.

Two separate PHP problems still in play

Two other PHP bugs are distinct from PHP2Shell. On Oct. 23, the PHP security team published mitigation guidance for CVE-2026-115560, an RCE flaw with no patch. It can be exploited only on systems "with an unusual combination of configuration and application code," according to PHP, and the interim advice involves session upload progress settings.

The second is CVE-2026-111497, an out-of-bounds write in the Brotli decoder library, tracked under names including Broccoli2Shell, HTTP2Shell and Node2Shell. On Oct. 26, the PHP Foundation released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address it.

In those builds, the vulnerable decoder is reachable through the cURL extension when automatic HTTP response decompression is enabled. The PHP Foundation says that setting is off by default in cURL, but applications and HTTP client libraries can turn it on. Brotli versions 1.0.10, 1.1.1 and 1.2.1 carry the fix, as do Node.js, Bun, Envoy Proxy, Istio, .NET and Python.

What comes next

The Oct. 29 federal deadline lands two days from now. The open technical question is the one Karimi flagged himself: whether the chain that worked against a single-worker mod_php setup holds up across other worker counts, PHP builds and applications.