Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Watch Update: PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 24, 2026
CISA updated its PHP2Shell alert late Friday, and the most important change is a single word. On Wednesday, CISA said it had "not observed exploitation." Friday's version says it has "not observed successful exploitation." That wording suggests attempts are now being seen, which matches Cloudflare's report of early attacks earlier in the week. Neither CVE is in the KEV catalog yet, but the distance between "attempted" and "successful" is the distance between this edition and a KEV listing with a three-day deadline.
What Changed Since Our KEV Watch Edition
The exploitation language shifted. CISA's wording moved from no observed exploitation to no observed successful exploitation. CISA has not published details on the attempts, and nothing confirms a compromise. But defenders should read the change as a signal that the window for orderly patching is narrowing.
Allied governments spoke with one voice. Alongside CISA, the NSA, the UK's National Cyber Security Centre, the Australian Cyber Security Centre, New Zealand's National Cyber Security Centre, and the Canadian Centre for Cyber Security have each issued their own alerts, and the Dutch NCSC published a php2shell GitHub repository. A coordinated response across the Five Eyes is uncommon, and it is a clearer read on how seriously governments view this vulnerability than any severity score.
There is now a detection rule. CISA released a SIGMA rule to help identify suspicious activity, published in its SIGMA Rules GitHub repository, and says it may update the rule as more information emerges. This turns the alert's "monitor for suspicious activity" guidance into something security teams can load into their SIEM today.
The fix and the guidance are unchanged. Patched releases remain PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CISA now explicitly notes PHP's assessment that Apache with mod_php carries the highest risk, consistent with our Thursday edition. Organizations that cannot update, or that run PHP 8.1 or earlier, should still take PHP-based systems offline until they can.
What to Do This Weekend
Load CISA's SIGMA rule and point it at web server and process logs, starting with internet-facing PHP systems. Finish the PHP inventory if it is still open, including appliances, vendor products, containers, and hosted CMS sites where PHP is not obvious. Verify fixes through your distribution's security advisory rather than the PHP version number, and restart PHP services so the patched code is running. For any system that was internet-facing and unpatched this week, preserve logs before you remediate, and treat a PHP worker launching a shell or download tool as an incident.
Assume a KEV listing could land with little notice. If you completed the inventory after our Thursday edition, a three-day deadline is manageable. If you did not, this weekend is the time.
Summary Status
| CVE | Product | Fixed In | KEV Status | |---|---|---|---| | CVE-2026-109618 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Not yet listed | | CVE-2026-109619 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Not yet listed |
We will publish dates and deadlines as soon as CISA adds either CVE to the catalog.
Sources: CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching · PHP Security Advisory · PHP Foundation Blog · NSA Advisory · NCSC-UK Alert · ASD's ACSC Alert · NCSC-NL php2shell Repository · NCSC-NZ Advisory · Canadian Centre for Cyber Security Alert · CISA SIGMA Rules Repository · CISA KEV Catalog
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 24, 2026
Mirai Operators Deploy Botnet Variant in PHP2Shell Campaign as ASLR Bypass Exploits Surface
Threat actors have pivoted PHP2Shell exploitation toward botnet deployment, with Sophos researchers observing attempts to install Potassium—believed to be a Mirai variant—through the CVE-2026-109618 and CVE-2026-109619 vulnerabilities. The development marks an evolution from initial reconnaissance activity to active payload deployment in the days following disclosure. Separately, researchers have developed proof-of-concept exploits that bypass Address Space Layout Randomization (ASLR) protections, potentially increasing the reliability of exploitation against vulnerable PHP installations. The operational impact of these campaigns has not been independently verified, though the exploit attempts continue at scale. Organizations in Japan and Finland took websites offline as a precautionary measure, with Dutch cybersecurity authorities warning the situation could deteriorate further.
Arista Patches Third VeloCloud Orchestrator Zero-Day in Four Months
Arista Networks disclosed CVE-2026-114625, a critical SQL injection vulnerability in VeloCloud Orchestrator that allows authenticated users to escalate privileges and access internal functionality. The flaw represents the third actively exploited zero-day in the VeloCloud platform within four months, indicating sustained targeting of the SD-WAN infrastructure. Arista confirmed active exploitation but has not disclosed victim counts or campaign scope. In law enforcement developments, the FBI arrested Edward Dubrovsky, a Toronto-area cybersecurity executive, on charges of colluding with cybercriminals in an extortion scheme, according to court documents. The UK's National Cyber Security Centre is investigating a Beijing-backed intrusion campaign amid concerns over potential compromise of sensitive information, though specific victims and operational details have not been disclosed.
Sources: The Hacker News · SecurityWeek · DutchNews · SecurityWeek · CBC · The Telegraph
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed attempting to exploit newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mir...
Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image
None of the flaws is known to be under attack. Cybersecurity. The weakness is the filename, not the picture. "The flaw is triggered by the filename, ....
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft identified Storm-0940, a China-linked espionage crew active since 2021, as responsible for the ConnectWise breach, with the attackers attemp...
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package was compromised and distributed via PyPI and Docker Hub with a credential stealer and backdoor, with the malicious ...
Max-severity GitLab bug allows remote code execution over 12 years of releases
Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'. Jessica Lyons Jessica Lyons Cybersecurity Editor.
Salt Typhoon: How China Walked Through America's Wiretap Backdoor — And Why It Is Still Not Fixed
A House Select Committee report from August 2026 found that Chinese state-owned telecom firms maintained equipment and network ties in the U.S. long a...
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Attackers are exploiting critical zero-day vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PHP after details leaked in advance of patches, with...
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP released an out-of-cycle security update for two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale, with government ...
Updated daily