Update: CISA Confirms PHP2Shell Is Being Exploited and Adds It to KEV

Update: This follows my posts on the two PHP2Shell flaws and the UK government outages.

BleepingComputer reports CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on Monday and gave federal agencies until Thursday to patch. PHP fixed both on October 21. Security firms saw exploit attempts before disclosure, and Amazon says targeting started four days before the patches. Over the weekend, honeypot evidence showed real remote code execution against Apache mod_php on PHP 8.4.26.

Separately, PHP shared mitigation for a third flaw, CVE-2026-115560, which still has no patch.

Checklist

• Update PHP on anything you run to the October 21 releases or later.
• Apply the published mitigation for CVE-2026-115560.
• Check web server logs for odd requests since mid-October.
• Don’t forget forgotten test boxes and old containers.

God Bless, and Needs Garlic!

References & Further Reading

• CISA confirms PHP2Shell vulnerabilities now exploited in attacks (BleepingComputer)
• My first PHP2Shell post
• My UK outages update