CISA adds 'php2shell' PHP flaws to its exploited-vulnerabilities catalog and urges immediate patching

The Cybersecurity and Infrastructure Security Agency added two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on Oct 26. CISA describes the catalog as its list of vulnerabilities "that have been exploited in the wild."

The flaws, known as "php2shell," allow unauthenticated remote code execution. CISA says they affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers mod_php setups the highest risk and says it has a demonstrated exploit in which an unauthenticated request can trigger the attack "before any application code runs."

Affected versions: the PHP project's advisories list affected versions as those earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 for both flaws.

The fix: PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct 21 to patch both bugs, and CISA tells organizations to update to them immediately.

The PHP advisory describes the two flaws:

CVE-2026-109618: out-of-memory handling can interrupt PHP while request data is only partly initialized (advisory).
CVE-2026-109619: internal state can outlive its freed memory and be reused by a later request (advisory).

What CISA recommends

Inventory every system running PHP, noting that PHP is often embedded in other software.
Patch internet-facing systems first.
Take PHP systems offline until they can be patched if they can't be updated right away or still run PHP 8.1 or earlier.
Watch for PHP worker processes launching shells or downloading tools.

CISA says a web application firewall "may provide some protection" until systems are patched.

CISA also published a SIGMA detection rule in an Oct 23 update to its alert.