CISA confirms PHP2Shell vulnerabilities now exploited in attacks

PHP2Shell is the collective name for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP. Attackers without privileges can exploit them in high-complexity attacks to gain remote code execution on unpatched systems. That makes them serious because the flaws can cross the boundary from a software weakness to control over a running server.

“Actively exploited” means exploitation has been observed outside a laboratory. CISA placed both flaws in its Known Exploited Vulnerabilities Catalog. Perplexity detection and response lead Adel Karimi confirmed evidence of remote code execution in a honeypot running Apache mod_php and PHP 8.4.26.

The PHP security team released patches on October 21. Before disclosure, firms including Cloudflare and Amazon detected widespread attempts, but classified them as unsuccessful. The later evidence of successful exploitation makes rapid remediation especially important for organizations running affected PHP systems.

CISA adds vulnerabilities to its Known Exploited Vulnerabilities Catalog when they present a demonstrated danger to organizations. PHP2Shell met that threshold because cybersecurity firms observed exploitation attempts, Amazon researchers saw targeting before patches, and Perplexity recorded remote code execution against a PHP installation. CISA called these vulnerabilities a frequent attack vector and a significant risk to the federal enterprise.

Federal Civilian Executive Branch agencies must secure affected systems by Thursday. That deadline comes from Binding Operational Directive 26-04. The directive applies specifically to FCEB agencies, so those organizations have the first mandatory action. CISA also encourages every organization to prioritize vulnerabilities in the KEV Catalog using risk-based vulnerability management.

The catalog listing signals urgency beyond ordinary patching advice. Organizations outside the federal executive branch are not bound by this particular directive, but exposed PHP systems still face risk. The article reports that attackers had already begun targeting PHP2Shell before patches became available.

Remote code execution, or RCE, is the central danger in PHP2Shell. It means an attacker can cause a vulnerable server to run code remotely rather than merely send it a normal web request. Because the attacker does not need privileges to exploit the two flaws, an unpatched system can become an entry point even before the attacker has an account.

The article gives a concrete example. Perplexity’s honeypots recorded RCE against an Apache mod_php installation running PHP 8.4.26. Once code runs on that server, the attacker may be able to perform actions available to the PHP or web-server process, such as reading or altering accessible files, depending on system permissions. Those specific follow-on actions are not described in the article.

The immediate implication is loss of control over the application environment. Attackers could potentially use that foothold to affect data, services, or other systems, but the extent depends on configuration and privileges. Patching removes the known vulnerability that enables the initial execution.

The potential exposure is large because PHP is used across roughly 70% of all websites. That figure does not mean every PHP site is vulnerable to PHP2Shell, but it shows how widely PHP-based systems are deployed. The relevant risk depends on the affected versions, configuration, and whether administrators installed the security updates.

VirusTotal estimates that more than 5.1 million PHP hosts are exposed online. Around 3.8 million instances have at least one port open to attacks. Those figures describe reachable PHP infrastructure, not confirmed PHP2Shell victims. They nevertheless show why attackers can find many potential targets and why internet-facing systems deserve urgent attention.

The article also reports exploitation attempts before public disclosure and successful RCE evidence in a honeypot. That combination makes the scale more than theoretical. Organizations should identify exposed PHP hosts, apply the PHP patches, and prioritize systems reachable from the internet, especially those running Apache mod_php.

The article reports that PHP2Shell details leaked before patches went live. The leaked material included the CVE identifiers and mitigation measures shared with critical infrastructure providers. Some proof-of-concept exploits also appeared online. That information could give attackers clues about what to investigate before defenders had an official fix.

The timeline was especially concerning. Amazon Threat Intelligence researchers said attackers began targeting PHP2Shell four days before security patches were released. Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack also detected widespread exploitation attempts before public disclosure. However, each firm classified the observed attempts as unsuccessful, and the PHP security team said the published proof-of-concept exploits were not functional.

The article does not identify the exact method attackers used or prove that the leaked material directly enabled every attempt. It does establish that targeting began early. This shows why confidential vulnerability coordination matters and why defenders should monitor exposed systems even before a patch becomes available.

A proof of concept is only one visible measure of danger. The PHP security team said the early PHP2Shell examples were not functional, but attackers could still study leaked details, CVE identifiers, and mitigation information. A nonworking demonstration can reveal the vulnerable code path or help researchers improve an exploit, even if it does not immediately compromise systems.

The timeline reinforces that point. Amazon Threat Intelligence researchers said attackers began targeting the flaws four days before patches were released. Several firms detected widespread attempts before public disclosure, and Perplexity later recorded remote code execution in a honeypot. These facts show that the threat existed independently of the quality of the first public proof of concept.

Installing the official updates closes the known vulnerabilities instead of relying on attackers’ current capabilities. The PHP security team urged security teams to install the updates as soon as they became available, and CISA later ordered FCEB agencies to patch by Thursday.

PHP is a programming language commonly used to build web applications. A web server receives a request and, when the application needs dynamic processing, passes relevant work to PHP. Apache can connect to PHP through mod_php, which processes the application code and helps produce the response returned to the visitor. The source article does not explain this architecture, so this paragraph uses standard technical knowledge.

The control risk appears in the request-processing path. If PHP or its Apache integration handles specially crafted input incorrectly, an attacker may cause the server to interpret data as instructions. With remote code execution, the resulting code runs within the server’s PHP or web-process context. The article’s example involved Apache mod_php running PHP 8.4.26.

That context limits or expands impact according to permissions and configuration. The article identifies two PHP flaws that can provide the initial RCE, but it does not describe their technical mechanism. Applying the patches removes the known vulnerable behavior from the processing chain.