Overview
On October 26, 2026, CISA added the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch agencies must secure affected systems by Thursday, as required by Binding Operational Directive 26-04.
The PHP security team rates both flaws CVSS v4.0 9.2 and says they can allow unauthenticated remote code execution.
| CVE | Description |
|---|---|
| CVE-2026-109618 | PHP remote code execution through out-of-memory (OOM) corruption |
| CVE-2026-109619 | PHP remote code execution through stale global state |
What Changed
Until now CISA had only published a Sigma detection rule. When it updated its alert on October 23 it said it had not observed successful exploitation. The KEV listing marks a change of position, following reports of working exploitation:
- Amazon Threat Intelligence observed an exploitation attempt on October 17, four days before public disclosure.
- Researcher Adel Karimi of Perplexity confirmed successful remote code execution against honeypot systems on October 24.
- The observed attack is a four-stage chain of HTTP requests. Some requests exhaust PHP memory, others leak memory contents, and the final request executes a shell command.
The evidence comes from a deliberately favorable single-worker mod_php setup. It does not measure how reliable the exploit is in other configurations.
For earlier coverage, see PHP2Shell flaws now successfully exploited in the wild.
Fixed Versions
PHP shipped fixes on October 21, 2026:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Tenable's FAQ notes a regression in PHP 8.4.27 and 8.5.12, so check release notes and test before rolling out widely. Windows builds with the bundled Brotli fix (CVE-2026-111497) were released on October 26.
Related Flaws
- CVE-2026-115560 is a separate RCE with no patch. It is only exploitable on systems with an unusual combination of configuration and application code. The PHP team has published mitigations.
- CVE-2026-111497 is an out-of-bounds write in the Brotli decoder library that can lead to unauthenticated RCE.
Recommended Actions
- Upgrade PHP to a fixed release, and restart PHP-FPM, Apache, or other worker processes so the patch takes effect.
- Prioritize internet-facing hosts running
mod_php, where working exploitation was observed. - Hunt for exploitation attempts in web server logs using the CISA-provided Sigma rule, covering activity from October 17 onward.
- Rebuild and redeploy container images that bundle PHP.
- Apply the vendor mitigations for CVE-2026-115560 until a patch is available.