CISA mandates urgent patching of PHP2Shell vulnerabilities following active exploitation

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical security vulnerabilities, collectively identified as "PHP2Shell," to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2, indicating a high risk for remote code execution.

Researchers, including security analyst Adel Karimi, have documented successful exploitation attempts targeting servers running Apache mod_php. These flaws allow unauthenticated attackers to execute arbitrary commands on compromised systems, presenting a severe risk to web infrastructure relying on outdated PHP versions.

CISA has issued a directive requiring all US federal civilian executive branch agencies to remediate these systems no later than October 29. The agency also advises organizations to conduct thorough forensics to determine if systems were compromised prior to the patching process.

The PHP project released security updates on October 21 addressing the flaws in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For administrators unable to update immediately, CISA recommends taking affected services offline or implementing web application firewall protections to mitigate the threat.