CISA Confirms Active Exploitation of PHP2Shell Flaws as Federal Agencies Race to Patch
Two critical PHP vulnerabilities rated 9.2 went from patch-drop to confirmed-in-the-wild in six days, with Amazon Threat Intelligence saying attackers were already hitting them before the fix landed.
CISA added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on October 27, 2026, and gave Federal Civilian Executive Branch agencies until Thursday to apply the fix, per the agency’s confirmation that the flaws are now being actively exploited in the wild. The stakes are not abstract: PHP underpins roughly 70 percent of all websites, and Censys had already counted 32.51 million hosts still running an affected version at the time CISA issued its warning. The two CVEs in question, 2026-109618 and 2026-109619, are both rated 9.2 on the CVSS scale and both enable unauthenticated remote code execution, meaning an attacker needs no credentials, no session, no prior foothold on the target to plant a shell.
The exploitation window is what makes this incident more urgent than a typical high-severity CVE. Patches landed on October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. But Amazon Threat Intelligence said attackers began targeting the flaws roughly four days before those patches shipped, which means the window of unpatched exposure was not a gap that opened after the fix and closed when sysadmins eventually ran their update cycle. It was a gap that was already open, and widening, before the vendor had even cut the release. Adel Karimi at Perplexity independently confirmed successful RCE on honeypot instances on October 24, reporting what he described as “confirmed RCE with usable memory disclosure,” which in practical terms means the exploit does not merely open a shell; it leaks memory that lets the attacker escalate and persist.
The Hacker News noted that dozens of downstream vendors, including Adobe, Siemens, Splunk, and Okta, had already issued their own advisories embedding or depending on the affected PHP versions, a long tail of products for which a patch in the underlying runtime is necessary but not sufficient. Every one of those advisories means a separate update pipeline, a separate change-freeze window, a separate incident ticket for an IT team that is now reading a CISA directive ordering patch-by-Thursday rather than patch-by-end-of-quarter. The federal deadline compresses what would ordinarily be a two-week rollout into a single weekend, and for agencies running PHP in constrained or air-gapped environments, Thursday is not a comfortable target.
The naming of PHP2Shell as a coherent vulnerability class, rather than two isolated bugs, is itself a signal about how the PHP extension ecosystem is being targeted. The flaws are not in the core interpreter but in how PHP interacts with the shell and process-spawning layer, which is precisely the seam an unauthenticated remote attacker is looking for: a way to turn a language runtime into a command-execution primitive without ever logging in. Karimi’s “usable memory disclosure” detail underscores that the exploit chain is not a one-shot injection but a multi-stage operation, and that the patches, while they close the specific vector, do not retroactively erase whatever already ran on a host that was unpatched during the pre-fix window.
For the operators of those 32.51 million hosts, the practical question is no longer whether to patch but whether they can determine whether they were already patched. A system that was unpatched between roughly October 17 and October 21, and that received meaningful traffic in that window, should be treated as compromised until a forensic pass says otherwise. The CISA directive makes that determination mandatory for federal systems by Thursday. For the rest of the web running PHP, the same logic applies, minus the deadline.