Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: October 27, 2026
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 26, 2026
CISA added both PHP2Shell vulnerabilities to the KEV catalog on October 26, with a remediation deadline of October 29, this Thursday. Readers of our two KEV Watch editions have had nearly a week of lead time. For everyone else, the deadline arrives fast, and the more pressing problem is that exploitation began long before the listing. Any internet-facing PHP system that went unpatched last week should be treated as a candidate for compromise, not just a patching ticket.
What Changed: From Attempts to Confirmed Exploitation
Last Friday, CISA's alert said it had "not observed successful exploitation." The KEV listing means that has changed. CISA has not published the evidence behind the listing, but third-party reporting describes the scale of the activity that preceded it.
Mass exploitation started almost immediately. Cloudflare researchers reported tens of thousands of exploitation attempts within the first 45 minutes after disclosure, hundreds of thousands within two hours, and millions by October 22. Whatever the success rate, the volume means virtually every exposed PHP server has already been tested.
At least one organized campaign is working through a target list. Threat intelligence firm Cyfirma reports a group it suspects is linked to North Korea, coordinating over a private I2P channel it has monitored since October 22. On October 24, the operators reported 216 unpatched or partially mitigated hosts and named 21 scanning nodes, with about a third of the targets checked at that point. The same addresses were seen running web-shell tooling and upload-progress session-poisoning attempts. The attribution comes from a single vendor and should be treated as an assessment, but the tradecraft details are useful to defenders regardless of who is behind them.
The scanning is built to stay quiet. Cyfirma describes slow, low-volume scanning from rotating machines, with any node that hits filtering or rate limiting retired. Rate-based alerting is unlikely to catch it. Organizations that judged their exposure by the absence of noisy alerts last week should not take comfort from that.
Operational guidance: Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or verify the fix through your distribution's security advisory, and restart PHP services so the patched code is running. Systems on PHP 8.1 or earlier, which receive no official fix, should be taken offline until upgraded or patched through a vendor backport.
Assume Compromise Where the Window Was Open
With exploitation running at this scale since October 21, patching alone does not settle the question for any system that was exposed and unpatched during that period. Patch first, but preserve logs before you do, and then hunt.
- Web shells. Check web roots and upload directories for PHP files created or modified since October 21, especially in paths your application doesn't normally write to.
- Upload-progress session poisoning. This is the technique the public proof-of-concept relies on, and it matches activity reported in the wild. Review requests carrying upload-progress fields and unexpected session files.
- Process behavior. Alert on PHP worker processes (php-fpm, httpd, apache2, lsphp) spawning shells or download tools such as curl and wget. CISA's SIGMA rule, published in its SIGMA Rules GitHub repository, covers this ground and is the fastest way to get detection running.
- Low-and-slow requests. Because the scanning deliberately avoids rate thresholds, search logs for the request patterns themselves rather than spikes in volume.
If you find evidence of compromise, rebuilding from a known-good state is safer than cleaning in place: web shells are cheap to plant in multiple locations, and credentials stored on the server, such as database passwords and API keys, should be rotated.
Operational guidance: For federal agencies and contractors, document each internet-facing PHP system with two answers: when it was patched, and what the hunt found. A system that was exposed from October 21 until the patch should be recorded as a compromise assessment under BOD 26-04, not closed as a routine update. Expect agency customers to ask for exactly that record.
Summary Deadline Status
| CVE | Product | Fixed In | KEV Added | Deadline | |---|---|---|---|---| | CVE-2026-109618 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 26 | Oct 29 | | CVE-2026-109619 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 26 | Oct 29 |
Both entries are due Thursday. PHP 8.1 and earlier have no official fix, so for those systems the only compliant paths are an upgrade, a vendor-backported package, or discontinuing use.
Sources: CISA: Two KEV Additions (Oct 26) · CISA Alert: Critical Vulnerabilities in PHP · CISA KEV Catalog · PHP Security Advisory · Security Affairs: CISA Adds PHP2Shell to KEV · CISA SIGMA Rules Repository · SOCRadar: PHP2Shell · Tenable: PHP2Shell FAQ
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 27, 2026
Ransomware Operators Exploit Zero-Day PAN-OS Vulnerability to Target VPN Access
Ransomware groups including Qilin and INC are actively exploiting PAN-OS vulnerability CVE-2026-0257 to bypass authentication and gain unauthorized VPN access, according to Unit 42 researchers at Palo Alto Networks. The authentication bypass flaw, disclosed in May 2026, is now being weaponized in intrusion campaigns targeting organizations running vulnerable firewall configurations. The exploitation enables attackers to establish initial access without valid credentials, though the full scope of affected organizations and successful compromises has not been disclosed. Separately, researchers report that attackers are exploiting a third Arista VeloCloud Orchestrator zero-day (CVE-2026-114625) in four months, a critical SQL injection flaw that Arista Networks has now patched. The sustained targeting of VeloCloud infrastructure suggests continued attacker interest in SD-WAN platforms as an intrusion vector.
Japan's GMO Internet Warns Customers to Disconnect Systems Ahead of Threatened Ransomware Attack
GMO Internet Group issued an unprecedented warning to customers to back up data and disconnect computers after threat actors demanded $50-51 million and threatened to deploy ransomware and leak customer information. The warning follows a breach of GMO's virtual desktop cloud service used for foreign exchange trading, with attackers claiming to have published customer data after ransom demands were not met. GMO's CEO publicly acknowledged the service had security vulnerabilities the company was slow to remediate. The scope of data exposure, number of affected customers, and verification of attacker claims remain unclear. Separately, threat actors reportedly breached Australian booking management provider RMS Cloud, affecting multiple holiday parks and customer data, and claimed access to crisis communications firm Sodali, though the extent of these compromises has not been independently verified. Researchers also observed threat actors exploiting Magento CMS blocks to inject JavaScript into compromised storefronts while evading malware detection, and attempting mass exploitation of PHP2Shell vulnerabilities to deploy Mirai botnet variants.
Sources: Unit 42 Palo Alto Networks · SecurityWeek · Bloomberg · The Register · Japan Times · ABC News · GBHackers · The Hacker News
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Ambulance Traffic Diverted, Clinical Appointments Cancelled and Classes Cancelled Due to ...
The University of New Mexico Health System is experiencing a cybersecurity issue at this time. UNM Health officials are actively working to ...
South Carolina launches program to protect rural hospitals from cybersecurity attacks
Project Lifeline 250 will help rural hospitals identify cybersecurity risks, strengthen their defenses and restore critical systems after an ...
Critical PHP flaws could let hackers take over church websites
Congregations are urged to act now, even if someone else manages their site. Two critical security vulnerabilities in PHP, the programming ...
PHP Vulnerability Exploits Spark 'Black October' Cybersecurity Surge
With AI-driven hacking and large-scale cyberattacks surging this month, the cybersecurity industry has coined the term “black October.” According to ....
Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Qilin and INC are actively exploiting PAN-OS vulnerability CVE-2026-0257 to bypass authentication and gain unauthorized...
Microsoft: China Hackers Unleash AI-Powered Cyberattacks Targeting Supply Chains
Microsoft has warned that Chinese state-aligned hackers have unleashed a sophisticated new wave of artificial intelligence-powered cyberattacks ...
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed attempting to exploit newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mir...
Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image
None of the flaws is known to be under attack. Cybersecurity. The weakness is the filename, not the picture. "The flaw is triggered by the filename, ....
Updated daily