Overview
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Federal civilian agencies must patch by Thursday, October 29, 2026.
Both flaws are rated CVSS 9.2 and allow unauthenticated remote code execution:
| CVE | Description |
|---|---|
| CVE-2026-109618 | Out-of-memory corruption |
| CVE-2026-109619 | Stale internal request state |
Censys estimates more than 32.51 million PHP services still run an affected version.
Patched Versions
The PHP project released fixes on October 21, 2026:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Evidence of Exploitation
On October 24, researcher Adel Karimi of Perplexity reported successful remote code execution against honeypot systems. The exploit returned an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appeared in the follow-on payload.
Karimi cautioned that this was demonstrated on a single-worker mod_php configuration and does not measure reliability across other worker counts, PHP builds, or applications.
Related Brotli Flaw
A separate bug, CVE-2026-111497 (nicknamed Broccoli2Shell, HTTP2Shell, or Node2Shell), is an out-of-bounds write in the Brotli decoder that can lead to privilege escalation and unauthenticated RCE.
- On Windows PHP builds, it is reachable through the cURL extension when automatic HTTP response decompression is enabled. That setting is off by default but can be enabled by applications.
- Affected Brotli versions: 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. Fixed in 1.0.10, 1.1.1, and 1.2.1.
- The PHP Foundation released patched Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 on October 26.
Recommended Actions
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or later. On Windows, use the
-1rebuilds. - Check downstream products that bundle PHP, including CMS platforms and appliances, and apply their vendor advisories.
- Inventory internet-facing PHP hosts, including containers and legacy servers that are rarely rebuilt.
- Monitor for unusually large cookie headers and unexpected child processes spawned by the web server user.
No interim workaround has been published, so patching is the only reliable fix.