US agency lists two PHP flaws as exploited by hackers
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities Catalog on Monday. Federal civilian agencies must secure their systems by Thursday, 29 October.
The two flaws are known together as PHP2Shell. Researchers say an attacker without privileges can use them to run code remotely on unpatched servers. One report rated both bugs 9.2 on the CVSS scale. The PHP security team released patches on 21 October.
Amazon Threat Intelligence researchers said attackers began targeting the flaws four days before the patches came out. Perplexity researcher Adel Karimi said honeypots recorded remote code execution over the weekend. The honeypots ran PHP 8.4.26 on an Apache mod_php install.
Delft University's Threat Intelligence Lab tracked more than 50,000 exploitation requests from over 600 IP addresses. Of these, 171 sent exploit code or malware droppers. PHP powers roughly 70% of all websites. VirusTotal estimates put the number of exposed PHP hosts at more than 5.1 million.
CISA also updated its PHP Alert, titled "Critical Vulnerabilities in PHP Require Immediate Patching". The deadline for federal agencies falls under Binding Operational Directive 26-04.
Key facts
- Who
- U.S. government cyber agency (warns of active exploitation of PHP web bugs (agency not named in the text)); Adel Karimi (Perplexity detection and response lead); Cybersecurity and Infrastructure Security Agency (US agency that added the flaws to its Known Exploited Vulnerabilities Catalog); Amazon Threat Intelligence (researchers who said attackers began targeting the flaws four days before…)
- What
- The U.S. government cyber agency warns that hackers have found a way to exploit the popular PHP software, which the description says is used in 70% of the web's software. Only a headline and description were available, so no further details are known.
- When
- 27 October 2026
- Status
- Reported