CISA Confirms PHP2Shell Is Being Exploited in the Wild

CISA added the two PHP flaws known collectively as PHP2Shell to its Known Exploited Vulnerabilities catalogue on 26 October 2026, listing CVE-2026-109618 as a PHP memory corruption vulnerability and CVE-2026-109619 as a PHP stale internal request-state vulnerability. The agency updated its standing alert, Critical Vulnerabilities in PHP Require Immediate Patching, in the same notice. Both flaws score 9.2 on CVSS and allow unauthenticated remote code execution.

The listing is a reversal. The Register reported that a week earlier CISA had warned about the danger PHP2Shell posed while saying it had not yet observed successful exploitation in the wild. Adding a vulnerability to the catalogue means the agency now considers it actively exploited.

A shell on a honeypot, then the catalogue

What moved in between was evidence from outside government. The Hacker News reported that Adel Karimi, detection and response lead at Perplexity, confirmed successful remote code execution against honeypot systems on 24 October 2026. Computer Weekly reported that the detection involved an Apache mod_php installation running PHP 8.4.26 in a sequestered honeypot environment, and that it emerged publicly on Sunday 25 October.

Karimi was careful about what the result proves.

That caveat matters because the flaws reach almost every way of running PHP against web traffic. CISA's advisory names Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, and singles out mod_php as carrying particularly high risk. The only demonstrated chain so far runs against the narrowest of those configurations.

Parallax Nexus reported on 24 October that botnet traffic, a working ASLR bypass and a publicly browsable attacker toolkit had all appeared around PHP2Shell without any vendor reporting a successful compromise. That is the gap the honeypot result and the catalogue entry have now closed, at least on the question of whether the flaws work.

What the 29 October date actually requires

Federal civilian executive branch agencies have until 29 October 2026 to act. The obligation runs through Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, which tells agencies to prioritise rapid remediation of catalogued vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation, and to defer lower-risk work. The directive also sets expectations for when agencies must check whether attackers compromised a system before the patch was applied. CISA encourages non-federal organisations to follow the same approach without binding them to it.

The patches have existed since 21 October 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Censys estimates more than 32.51 million PHP services still run an affected version, and warns that hosts on end-of-life branches between PHP 5.4 and 7.3 will never receive a fix and have to move to a supported branch. W3Techs puts PHP behind roughly 70 per cent of websites. On 26 October the PHP Foundation also shipped Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder.

What CISA has not said is who was hit. The Register noted that the agency disclosed neither the compromised organisations nor any detail of the attacks behind the decision, and that the listing confirms exploitation without confirming how many production systems were successfully breached. Dataminr, publishing on 27 October, went further and said it remained difficult to identify active successful exploitation from a reputable source.

The honest reading is that the catalogue entry is a procurement instrument, not a damage report. It converts a contested research finding into a legal deadline for several hundred federal networks, which is useful even if the underlying exploitation turns out to be narrow and opportunistic. The number worth watching is not 32.51 million exposed services but how many of them sit behind mod_php on a single worker, the one configuration anybody has demonstrated a reliable chain against.