PHP2Shell vulnerabilities confirmed exploited, CISA adds them to KEV Catalog

CISA has added two critical PHP flaws, collectively called PHP2Shell, to its Known Exploited Vulnerabilities Catalog after evidence of exploitation appeared in the wild. According to BleepingComputer, the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can be used by attackers without privileges in complex attacks to gain remote code execution on unpatched systems.

PHP2Shell vulnerabilities: what we know

The PHP security team published patches for the two flaws on Wednesday, October 21, and urged rapid installation, according to BleepingComputer. BleepingComputer reports that details about the vulnerabilities and some proof-of-concept code appeared online before the patches were available, but the PHP team said those published proofs were not functional. Multiple security firms, including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack, detected widespread exploitation attempts before public disclosure, and most of those detections were labeled unsuccessful.

CISA formalized the situation by adding the two CVEs to its KEV Catalog and issuing remediation guidance under Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize and remediate listed vulnerabilities quickly, according to CISA. BleepingComputer also reports that Amazon Threat Intelligence observed attackers targeting the vulnerabilities several days before the patches were released, and Perplexity recorded evidence of remote code execution against an Apache mod_php instance running a specific PHP release.

The PHP team also shared mitigation information for a separate RCE issue, CVE-2026-115560, for which no patch was available at the time of reporting, according to BleepingComputer.

Why this matters for small organizations, nonprofits, and public teams

BleepingComputer cites a VirusTotal estimate that PHP powers roughly 70 percent of websites, with millions of PHP hosts exposed online. That prevalence means many small sites and public sector applications could be running vulnerable code or configurations. CISA points out that these types of vulnerabilities are a frequent attack vector and can pose significant risks to the federal enterprise, which is why the agency put these CVEs in the KEV Catalog and ordered prioritized remediation for federal agencies.

Even when published exploits start out incomplete, attackers often adapt quickly, and security vendors reported attempts against internet-facing systems before patches were broadly available. The presence of active targeting, even if initial attempts were unsuccessful, raises the risk that follow-up campaigns will succeed on unpatched and poorly monitored systems.

What to check now

• Confirm whether any of your publicly exposed hosts run PHP, and identify which PHP engine or deployment you use (for example mod_php). According to BleepingComputer, Apache mod_php was among the configurations seen exploited.
• Check whether your systems have been patched with the fixes the PHP team published after October 21, and prioritize any internet-facing PHP instances.
• Review server and application logs for signs of remote code execution or unexpected activity before and after applying patches; CISA’s guidance for KEV Catalog items emphasizes checking for compromise prior to patching in some cases.
• If you rely on third-party hosting, managed platforms, or plugins, confirm with the provider whether they have applied the PHP updates or mitigation measures.
• Use risk-based prioritization: CISA encourages organizations to treat KEV Catalog entries as high priority, even though BOD 26-04 applies to federal agencies.

(If you want a quick external check of whether your site is exposed, start with a free external scan: Want to know how exposed your own site is? Start with a free external scan.)

Practical steps and short-term mitigations

• Apply the official PHP updates the PHP security team released as soon as you can to any affected hosts. BleepingComputer reports those patches were published on October 21.
• Where you cannot apply a patch immediately, implement temporary mitigations the PHP team or your vendor recommends, and restrict external access to vulnerable services where possible.
• Prioritize internet-facing assets that match the PHP configurations under active targeting, and consider isolating or taking noncritical services offline until patched.
• Verify backups and incident response plans so you can recover quickly if a breach is discovered during log reviews.
• If you find evidence of compromise, follow your incident response procedure and consider engaging a responder who can examine indicators and scope of impact.

What happened next and what to watch for

CISA’s addition of the PHP2Shell CVEs to the KEV Catalog means federal agencies must act under BOD 26-04, and CISA has encouraged all organizations to adopt similar risk-based remediation priorities. Security vendors will likely publish additional detection rules and indicators, and exploit attempts may continue as attackers test or refine code that initially failed. BleepingComputer and CISA both point to the importance of rapid remediation and monitoring for signs of post-exploitation activity.

If your organization uses PHP, treat these CVEs as high priority: identify affected hosts, confirm patches or mitigations are in place, and review logs for suspicious behavior. For quick exposure checks, consider the free external scan linked above and follow vendor and PHP security team guidance as it is updated.

Sources: reporting from BleepingComputer and an alert from CISA.