CISA Confirms Active Exploitation of PHP2Shell Flaws: Urgent PHP Patching Required

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially confirmed the active exploitation of two critical Remote Code Execution (RCE) vulnerabilities in PHP, collectively dubbed PHP2Shell. These vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, underscoring their severe risk and the immediate need for action.

PHP2Shell Critical Flaws: Details and Risks

Both vulnerabilities carry a CVSS v4.0 score of 9.2 and reside in the PHP core, not in any specific framework or plugin. This means they impact any system running PHP to serve web requests. No authentication is required for exploitation; an attacker only needs to reach a PHP endpoint over HTTP with a specially crafted request. Affected server setups include PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed, with PHP rating mod_php as the highest risk.

Details of the flaws leaked before the planned embargo, prompting the PHP security team to swiftly release fixes on October 21. However, exploitation attempts were observed as early as October 17, four days before public disclosure, as reported by AWS.

Confirmed Exploitation and Indicators of Compromise

CISA’s confirmation means both flaws are actively being exploited, setting an October 29 deadline for federal civilian agencies to address them. While CISA warned of the danger last week, it had not observed successful exploitation in the wild until now. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php, leveraging memory exhaustion and disclosure to achieve RCE.

Delft University’s Threat Intelligence Lab has tracked over 50,000 PHP2Shell exploitation requests from more than 600 IP addresses across 70 countries. Of these, 171 addresses went beyond probing for vulnerable servers and began sending exploit code or malware droppers.

Recommended Actions and Mitigation Strategies

To secure systems, it is paramount to update PHP to the patched versions immediately. If immediate patching is not feasible, isolating internet-facing PHP applications and deploying WAF or IDS rules are recommended. A partial mitigation, such as setting session.upload_progress.enabled=0, only blocks one demonstrated path for CVE-2026-109619 and does not address CVE-2026-109618.

Patched PHP Versions:

For PHP versions 7.4, 8.0, and 8.1, PHP has published minimal source backports, but no official releases are available for these branches. These should be considered a stopgap measure, with a full upgrade planned.

Discovering Vulnerable PHP Installations

Identifying all PHP installations can be challenging, as PHP often resides in various locations, including OS packages, Homebrew, bundled copies on Windows, and within custom applications and containers. It is crucial to inspect the PHP binaries themselves, as the version string (e.g., X-Powered-By: PHP/x.y.z) is embedded, allowing for exact version identification without execution. For organizations utilizing Tanium solutions, specific tools are available to discover and inventory vulnerable PHP installations across the entire infrastructure.