Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Watch: PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 22, 2026
This is a KEV Watch edition: neither of these vulnerabilities is in the KEV catalog yet. We are covering them now because CISA has already issued guidance stronger than most KEV entries carry, telling organizations that cannot patch, or that run PHP 8.1 or earlier, to take PHP-based systems offline. If exploitation is confirmed, a KEV listing will likely follow with a short deadline. The time to inventory is before that clock starts, not after.
What's Confirmed, and What Isn't
The PHP project shipped fixes on October 21 for two critical flaws, nicknamed "PHP2Shell":
- CVE-2026-109618: remote code execution caused by memory corruption when PHP handles an out-of-memory condition partway through setting up a request.
- CVE-2026-109619: remote code execution caused by stale state, where data belonging to one request survives into the next request handled by the same worker.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier are end-of-life and get no official release, though the PHP project published minimal source backports for 7.4, 8.0, and 8.1, and some Linux distributions and long-term-support vendors ship their own patched packages. CISA describes the flaws as unauthenticated remote code execution affecting all PHP installations that serve web requests.
Two points remain unsettled, and the honest answer is to say so. On exploitation, Cloudflare reports seeing early attacks and has deployed WAF rules, but has not said whether any succeeded; CISA said on October 21 it had not observed exploitation. On difficulty, a public proof-of-concept exists, but it depends on specific settings plus a separate flaw in the target application. PHP's own validation shows that is not the only route (see below), so plan as if a cleaner exploit is coming.
Operational guidance: Treat the lack of confirmed exploitation as a head start, not a reason to wait. The flaw was found with AI assistance, the fix was rushed out after a leak, and researchers have already reproduced at least one of the bugs. That is the profile of a vulnerability that moves to mass exploitation quickly.
Who's Most Exposed
mod_php deployments come first. Every PHP server stack is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. But PHP rates mod_php highest risk, because its validated exploit runs before any site code, so the site doesn't need a flaw of its own. PHP confirmed full remote code execution over HTTP against mod_php with default settings. Its validation of CVE-2026-109619 on PHP-FPM depends on how the application behaves. If you need to triage, Apache with mod_php goes to the top.
PHP you don't know you're running. CISA notes that PHP is often a component of other software and may not be directly visible. Appliance management consoles, vendor web portals, monitoring tools, and admin utilities such as phpMyAdmin all carry PHP their owners rarely think about. A server inventory that looks only for "web servers" will miss them.
End-of-life installations. One count found roughly 880,000 internet-facing hosts on PHP 8.1 or earlier, which receive no official release. Many are small-business and WordPress sites on shared hosting, legacy internal apps, and contractor-built portals nobody has touched in years.
Your hosting provider may act first. DigitalOcean has notified all customers, is suspending its PHP-based Marketplace images (WordPress, LAMP, LEMP, Laravel) until they are patched, and says it may temporarily restrict traffic to resources showing signs of compromise. Expect other providers to follow. For organizations that rely on hosted sites, an unpatched server may simply go dark.
What to Do
- Inventory first. Find every system running PHP, internet-facing ones first, including appliances, vendor products, containers, and one-click CMS images. On Linux hosts, check both the host and any containers; a single
docker exec <container> php -vacross running containers surfaces the PHP you forgot about. - Verify fixes through vendor advisories, not version numbers. Distribution packages often backport the fix without changing the PHP version number. A patched Ubuntu or RHEL system may still report an older version, and an unpatched one may report a number that looks fine. Check the distribution's security advisory for the package build.
- Patch PHP, then patch the application. Upgrading PHP fixes the interpreter. WordPress, Laravel, and other PHP applications may need their own updates from their maintainers, so confirm both.
- Preserve before you patch exposed systems. For anything that was internet-facing and unpatched, capture web server logs and, where possible, a disk snapshot before updating. Restart PHP services after patching so the fixed code is actually running.
- Take end-of-life PHP offline if it cannot be upgraded or backported right away. CISA and the UK NCSC both recommend this, and it is the right call for federal and contractor systems.
- Treat stopgaps as stopgaps. The PHP Foundation has published measures that block specific attack paths, and Cloudflare's WAF rules cover known vectors for traffic routed through it. Neither makes an installation safe; PHP's maintainers are clear that upgrading is the only fix.
- Hunt. Alert on PHP worker processes (php-fpm, httpd, apache2, lsphp) spawning shells or download tools such as curl and wget, and on new files appearing in web roots.
Summary Status
| CVE | Product | Fixed In | KEV Status | |---|---|---|---| | CVE-2026-109618 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Not yet listed | | CVE-2026-109619 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Not yet listed | | PHP 8.1 and earlier | End-of-life | No official release; source backports for 7.4–8.1; vendor packages vary | Upgrade or take offline |
There is no BOD 26-04 deadline yet. If CISA adds these CVEs to the catalog, we will publish a follow-up with the dates and what changed since this edition. Contractors should not wait for it: an agency customer asking about PHP2Shell next week will want an inventory and a remediation record, not a plan.
Sources: CISA KEV Catalog · PHP Security Announcement · NVD: CVE-2026-109618 · NVD: CVE-2026-109619 · Expel: Php2Shell · Tenable: PHP2Shell FAQ · Help Net Security: PHP2Shell Patched · watchTowr: PHP RCE FAQ · Sherlock Forensics: Preserve Before You Patch
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 23, 2026
PHP2Shell Exploitation Escalates to Millions of Attempts, Pre-Disclosure Activity Confirmed
Exploitation of the PHP2Shell vulnerabilities has surged to millions of attempts within 48 hours of public disclosure, with Cloudflare reporting attacks escalating from thousands before the announcement to millions afterward. Amazon Threat Intelligence revealed that exploitation attempts began at least four days before the October 21 public disclosure, with initial activity detected on October 17, indicating threat actors obtained exploit information through pre-disclosure channels. Despite the massive volume of exploitation attempts targeting the flaws in PHP—which powers 70% of websites globally—security researchers report minimal evidence of widespread successful compromises or damage, suggesting defensive measures and rapid patching efforts have been largely effective. Governments and organizations worldwide continue emergency patching operations as the attack surface remains significant.
China-Linked Storm-0940 Used ARTEX AI Framework in ConnectWise Supply Chain Attack
Microsoft formally attributed the ConnectWise supply chain compromise to Storm-0940, a China-state aligned threat group that leveraged ARTEX AI agents to conduct automated reconnaissance and exploitation at scale. The operation reached over 2,250 customer tenants with attack attempts occurring at rates exceeding 2,900 sign-in attempts per minute, demonstrating AI-enhanced operational tempo. The attribution confirms earlier reporting of AI-assisted techniques but provides specific details on the threat actor and tooling. Separately, Arista Networks disclosed active exploitation of a zero-day SQL injection vulnerability (no CVE assigned) in VeloCloud Orchestrator that allows attackers to escalate from read-only customer accounts to full operator privileges. Unit 42 researchers also reported that ransomware operators Spikey Scorpius and Tarnished Scorpius are actively exploiting the previously disclosed PAN-OS authentication bypass vulnerability CVE-2026-0257 in targeted campaigns.
Sources: NPR · ABC · Security Affairs · The Hacker News · CyberScoop · The Hacker News · Unit 42
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Microsoft identified Storm-0940, a China-linked espionage crew active since 2021, as responsible for the ConnectWise breach, with the attackers attemp...
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package was compromised and distributed via PyPI and Docker Hub with a credential stealer and backdoor, with the malicious ...
Max-severity GitLab bug allows remote code execution over 12 years of releases
Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'. Jessica Lyons Jessica Lyons Cybersecurity Editor.
Salt Typhoon: How China Walked Through America's Wiretap Backdoor — And Why It Is Still Not Fixed
A House Select Committee report from August 2026 found that Chinese state-owned telecom firms maintained equipment and network ties in the U.S. long a...
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Attackers are exploiting critical zero-day vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PHP after details leaked in advance of patches, with...
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP released an out-of-cycle security update for two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale, with government ...
US, allies warn of critical vulnerabilities in programming underlying 70% of the internet
... Cybersecurity and Infrastructure Security Agency — as well as the United Kingdom's National Cyber Security Centre, the Australian Signals ...
Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
Organisations around the world are scrambling to fix a critical cyber-security flaw that could affect millions of websites. The vulnerability is ...
Updated daily