US Authorities Warn of PHP2Shell Vulnerability Exploitation

a man dressed in armor and holding a shield — Matt Benson / Unsplash

US authorities have confirmed the exploitation of the vulnerability known as PHP2Shell, which was discovered in the programming language PHP. The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning on October 26, 2026, announcing the addition of vulnerabilities "CVE-2026-109618" and "CVE-2026-109619" to the Known Exploited Vulnerabilities (KEV) catalog.

These vulnerabilities, referred to as PHP2Shell, pose a risk of remote code execution without requiring authentication. "CVE-2026-109618" is associated with memory handling during low memory conditions, while "CVE-2026-109619" relates to the management of internal states concerning freed memory. The risk is particularly high in PHP environments that handle external requests, such as websites, prompting widespread caution from authorities.

On October 21, the PHP development team released versions "PHP 8.5.12", "PHP 8.4.27", "PHP 8.3.36", and "PHP 8.2.35", which include fixes for the vulnerabilities. Additionally, patches have been provided for the unsupported versions "PHP 7.4", "PHP 8.0", and "PHP 8.1" to apply to their source code. Backporting has also been performed in some Linux distributions.

CISA has specified a deadline of October 29 for federal agencies to address these vulnerabilities, which includes not only remediation but also verification of any potential compromises.