CISA confirms active exploitation of critical PHP2Shell vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Monday that attackers are actively exploiting two critical vulnerabilities in PHP, known collectively as PHP2Shell. These flaws, which allow unauthenticated remote code execution, have been added to the agency’s Known Exploited Vulnerabilities (KEV) catalog, signaling an urgent need for remediation across the global web infrastructure.

What happened

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both carry a severity rating of 9.2 on the Common Vulnerability Scoring System (CVSS). CVE-2026-109618 is an out-of-memory corruption issue, while CVE-2026-109619 involves stale internal request-state handling. Both enable attackers to execute arbitrary code on affected servers without needing prior authentication.

The confirmation of active exploitation follows evidence gathered by Adel Karimi, detection and response lead at Perplexity. On October 24, 2026, Karimi observed successful remote code execution attempts against honeypot systems. The attacks were not merely causing crashes; they resulted in usable memory disclosure. Karimi noted that the exploit chain delivered an 800 KiB decoded cookie dump, with function addresses derived from that dump appearing in subsequent execution payloads. This evidence specifically demonstrated the attack chain on a single-worker mod_php profile, though reliability may vary across different configurations.

In response to these threats, the PHP development team released patched versions on October 21, 2026. Federal agencies have been given until October 29, 2026, to apply these fixes. However, the scale of exposure remains massive. PHP powers approximately 70% of all websites, and estimates from Censys indicate that more than 32.51 million PHP services are still running vulnerable versions.

How it works

These vulnerabilities exploit deep-seated issues in how PHP manages memory and request states. CVE-2026-109618 leverages out-of-memory corruption, a condition where the software fails to handle memory allocation errors correctly, allowing an attacker to overwrite adjacent memory locations. CVE-2026-109619 exploits stale internal request-state data, where residual data from previous requests is improperly handled, creating a window for injection or execution.

The exploitation process involves sending crafted requests that trigger these memory management failures. Once the memory corruption or state confusion occurs, the attacker can inject malicious code into the server’s execution flow. In the observed cases, this led to the dumping of sensitive data like cookies and the derivation of function addresses, which are then used to stabilize the exploit and maintain persistent access. This technique bypasses standard authentication mechanisms entirely, granting the attacker full control over the compromised server.

Key details

• Vulnerability IDs: CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale internal request-state).
• Severity: Both vulnerabilities are rated 9.2 on the CVSS scale, indicating critical risk.
• Patched Versions: Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026.
• Active Exploitation: Confirmed by Perplexity researcher Adel Karimi on October 24, 2026, via honeypot analysis.
• Exposure: Over 32.51 million PHP services are estimated to be running affected versions.
• Additional Risk: Windows builds also face CVE-2026-111497, a Brotli decoder vulnerability patched in recent updates.

Why it matters

For software engineers and IT leads, the widespread use of PHP means that a significant portion of the internet’s backend infrastructure is currently at risk. The addition of these flaws to the CISA KEV catalog is a strong indicator that federal agencies and large enterprises will prioritize patching, but the sheer number of exposed services suggests that many smaller organizations and legacy systems remain vulnerable. The ability to execute code without authentication makes these flaws particularly dangerous, as they do not require stolen credentials or social engineering to initiate an attack.

The technical nature of the exploit, involving memory corruption and state management, highlights the complexity of securing server-side scripting languages. It also underscores the importance of keeping runtime environments up to date. With vendors like WordPress, Drupal, Cisco, and IBM issuing advisories, the ripple effect extends beyond just PHP installations to any product or service that embeds or relies on PHP. Failure to patch could result in complete server compromise, data theft, and potential lateral movement within corporate networks.

What you can do

• Upgrade PHP immediately: Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 if you are running an older version.
• Check Windows builds: If you use PHP on Windows, ensure you have installed the updated builds (e.g., 8.5.12-1) to address the Brotli decoder vulnerability CVE-2026-111497.
• Audit dependencies: Review any third-party applications or CMS platforms (like WordPress or Drupal) to ensure they are compatible with the patched PHP versions and update them accordingly.
• Monitor logs: Look for signs of unusual memory usage, unexpected process spawns, or large data exports that might indicate an ongoing exploitation attempt.
• Disable unnecessary features: If possible, disable automatic HTTP response decompression in cURL extensions, as this can mitigate the risk associated with the Brotli vulnerability on Windows.
• Apply vendor patches: Check for security advisories from hardware and software vendors listed in the global response, such as F5, Citrix, and Siemens, and apply their recommended fixes.