CISA Adds PHP2Shell to KEV After Real-World Exploitation

CISA confirmed that attackers have leveraged the PHP2Shell bugs, CVE-2026-109618 and CVE-2026-109619, and added them to its Known Exploited Vulnerabilities catalog on Oct. 26. The agency cited evidence of successful remote code execution (RCE) against Apache mod_php servers.

PHP2Shell Exploit Details

The two flaws share a CVSS score of 9.2. CVE-2026-109618 triggers memory corruption through out-of-memory handling, while CVE-2026-109619 abuses stale internal request state. Both allow attackers to run arbitrary code without authentication. The PHP team released patches on Oct. 21, but the bugs were already being targeted four days earlier, according to Amazon Threat Intelligence.

First Confirmed RCE

On Oct. 24, Adel Karimi of Perplexity reported a working RCE against a honeypot running Apache mod_php with PHP 8.4.26. The attack produced an 800 KiB decoded cookie dump, indicating memory disclosure. The test proved the flaw under that specific configuration, but it demonstrated that the vulnerability is exploitable in production.

Scope of Vulnerability

Censys estimates that 32.5 million active PHP installations run versions that could be affected. The bugs impact several PHP configurations, including Apache mod_php, PHP-FPM, and php-cgi. WordPress, Drupal, Craft CMS, Citrix, F5, and QNAP have all issued advisories for products that may rely on vulnerable PHP code.

Federal Patch Deadline

CISA gave federal civilian agencies until Oct. 29 to apply the fixes. The recommended releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators using older versions should verify with hosting providers or vendors for available patches.

The PHP team also disclosed CVE-2026-115560, a separate RCE risk tied to session.upload_progress.enabled. Administrators can mitigate temporarily by disabling that setting. Windows builds released on Oct. 26 addressed CVE-2026-111497, a Brotli decompression flaw that can affect PHP’s cURL extension.

Operational Impact for Agencies

Federal agencies that host web applications on Apache mod_php or similar stacks must prioritize patch deployment. Failure to update exposes mission-critical services to code injection, data exfiltration, and potential takeover of server processes. The urgency is amplified by the fact that attackers have already demonstrated the exploit in a controlled environment.

Vendor Response and Mitigation Steps

Vendors that ship PHP-based applications should verify that their distributions include the latest PHP releases. CMS platforms must audit their plugins and themes for compatibility with the patched PHP versions. Administrators should also review session handling configurations to avoid the CVE-2026-115560 vector.

What to Verify Now

  1. Identify the PHP version in use and confirm whether it falls under the affected range.
  2. Check the web server configuration—Apache mod_php is the most vulnerable.
  3. Apply the latest PHP patch (8.5.12, 8.4.27, 8.3.36, or 8.2.35) before Oct. 29.
  4. Disable session.upload_progress.enabled if the application does not require it.
  5. Monitor for signs of exploitation, such as unexpected memory dumps or unauthorized code execution.

For a deeper dive into how PHP vulnerabilities intersect with mobile app backends, see the NowSecure research that identified 426 Android and iOS apps connecting to potentially vulnerable servers.

Explore more on this topic