PHP flaws could run code after CISA added two CVEs to KEV

PHP web requests expose installations to php2shell

CISA described CVE-2026-109618 as a PHP memory corruption vulnerability and CVE-2026-109619 as a PHP stale internal request-state vulnerability. CISA said the php2shell vulnerabilities allow unauthenticated remote code execution in PHP.

The affected deployment types cover PHP installations that serve web requests. CISA specifically listed Apache with mod_php, which it said PHP considers its highest-risk configuration, as well as PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

CISA listed PHP updates and monitoring steps

CISA said organizations should “immediately update” PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. It also told defenders to identify and inventory systems running any PHP version across their organizations.

For systems that cannot be updated, or that still use unsupported PHP 8.1 or earlier, CISA said organizations should take PHP-based systems offline until they can be patched or updated. A web application firewall may provide some protection while updates are pending.

CISA also told defenders to monitor for PHP worker processes launching shells or downloading tools. The Record reported that Sophos and Palo Alto Networks posted and then retracted claims of successful exploitation, while several experts found ways to exploit the bugs by Oct. 25, 2026.

CISA said federal civilian agencies must prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that grant total control after exploitation. The agency also said these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

The Record reported that CISA declined to answer questions about the nature of the exploitation or potential victims. Censys reported that more than 10 million of 42 million internet-facing PHP services had been patched since Oct. 21.