CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA’s KEV catalog records vulnerabilities that are known to be exploited in real attacks. By adding CVE-2026-109618 and CVE-2026-109619, CISA confirmed that both PHP2Shell flaws had moved from theoretical risk to active exploitation. That designation raises their priority for defenders, especially federal agencies.

Both vulnerabilities carry a 9.2 CVSS rating. CVE-2026-109618 involves out-of-memory corruption, while CVE-2026-109619 involves stale internal request-state data. Each can allow an unauthenticated attacker to execute code remotely on an affected PHP deployment.

The confirmation followed evidence from honeypot systems on October 24, 2026. Adel Karimi of Perplexity observed successful remote code execution. Federal agencies must apply the fixes by October 29, while patched PHP releases became available on October 21.

Unauthenticated remote code execution means an attacker can make a vulnerable service run attacker-controlled instructions without supplying valid credentials. The attacker does not need an application account first. The service itself processes the malicious input and performs the resulting action.

That removes a major security barrier. An exposed PHP service could potentially be instructed to run commands, access data, or alter the server, depending on its permissions and configuration. The PHP2Shell flaws are especially serious because both support this attack path and each received a 9.2 CVSS rating.

The article reports confirmed execution on honeypot systems, including memory disclosure and a later execution payload. More than 32.51 million PHP services were estimated to be running affected versions. Updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 removes the addressed flaws.

The figures indicate a very large potential exposure, although they do not mean every website is vulnerable or exploitable in the same way. PHP is used in roughly 70% of websites, and Censys estimated that more than 32.51 million PHP services were still running an affected version.

The risk comes from the combination of reach and attack capability. PHP2Shell can support unauthenticated remote code execution, so attackers may not need an account before targeting a vulnerable deployment. The article also lists advisories from many vendors, including Drupal, WordPress, Craft CMS, QNAP, Cisco-related infrastructure vendors, and industrial technology companies.

The scale makes rapid patching important. PHP fixes were released on October 21, 2026, but vulnerable systems can remain exposed until administrators install them. The figures describe possible reach, not confirmed compromise across all services.

The strongest evidence came from Adel Karimi, Perplexity’s detection and response lead. On October 24, 2026, he confirmed successful remote code execution against honeypot systems. This distinguished PHP2Shell from an issue that merely crashes a process or creates a suspicious child process.

The response contained an 800 KiB decoded cookie dump. Karimi then identified a function address derived from that memory disclosure using offsets from the public exploit. That address appeared in the subsequent execution payload, linking the disclosed memory to the attack’s next step.

Karimi said the evidence demonstrated the chain on an intentionally favorable single-worker mod_php profile. He also cautioned that it did not measure reliability across other worker counts, PHP builds, or applications. The evidence therefore confirms usable execution in that tested setting, without proving universal exploit reliability.

Organizations that leave PHP unpatched may keep an internet-facing path to unauthenticated remote code execution open. An attacker could send requests that trigger the flaws and cause the affected deployment to perform unauthorized actions. The article does not specify one universal outcome, because impact depends on the deployment and its permissions.

The confirmed exploit chain included memory disclosure and a later execution payload. That means the danger is not limited to service crashes. A compromised PHP process could also place connected applications, information, or broader infrastructure at risk, depending on how the service is configured.

The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. CISA’s KEV addition confirmed active exploitation, so federal agencies were given until October 29 to complete the necessary updates.

PHP sits on the server side and processes requests for many websites and services. When a request reaches an affected PHP deployment, PHP may handle it before the application’s own login logic runs. A flaw in that processing path can therefore be attacked without an application account.

That is the basic reason PHP2Shell is described as unauthenticated remote code execution. The attacker targets the vulnerable PHP behavior itself, rather than successfully signing into a website. In the reported tests, the exploit chain used memory disclosure and then supplied an execution payload.

The exact exposure depends on how PHP is deployed. Karimi’s evidence came from an intentionally favorable single-worker mod_php profile, and he did not claim the same reliability for other worker counts, PHP builds, or applications. Still, the affected versions and broad PHP usage make patching important.

Memory corruption occurs when a program mishandles memory, such as writing outside an intended area or damaging data used by the process. Stale internal request state means later processing can use information left over from an earlier request or an invalid prior state. Both are programming flaws, but their effects depend on the surrounding code.

An attacker may exploit corruption to read memory or influence values that control program behavior. The PHP2Shell evidence showed this pattern: a response delivered an 800 KiB decoded cookie dump, and a function address derived from it appeared in the next execution payload. That linked disclosure with execution.

The article names CVE-2026-109618 as out-of-memory corruption and CVE-2026-109619 as stale internal request-state vulnerability. Both permit unauthenticated remote code execution. It does not provide a full technical exploit explanation, so the precise internal redirection mechanism is not stated.