Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Watch: PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 22, 2026
This is a KEV Watch edition: neither of these vulnerabilities is in the KEV catalog yet. We are covering them now because CISA has already issued guidance stronger than most KEV entries carry, telling organizations that cannot patch, or that run PHP 8.1 or earlier, to take PHP-based systems offline. If exploitation is confirmed, a KEV listing will likely follow with a short deadline. The time to inventory is before that clock starts, not after.
What's Confirmed, and What Isn't
The PHP project shipped fixes on October 21 for two critical flaws, nicknamed "PHP2Shell":
- CVE-2026-109618: remote code execution caused by memory corruption when PHP handles an out-of-memory condition partway through setting up a request.
- CVE-2026-109619: remote code execution caused by stale state, where data belonging to one request survives into the next request handled by the same worker.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier are end-of-life and get no official release, though the PHP project published minimal source backports for 7.4, 8.0, and 8.1, and some Linux distributions and long-term-support vendors ship their own patched packages. CISA describes the flaws as unauthenticated remote code execution affecting all PHP installations that serve web requests.
Two points remain unsettled, and the honest answer is to say so. On exploitation, Cloudflare reports seeing early attacks and has deployed WAF rules, but has not said whether any succeeded; CISA said on October 21 it had not observed exploitation. On difficulty, a public proof-of-concept exists, but it depends on specific settings plus a separate flaw in the target application. PHP's own validation shows that is not the only route (see below), so plan as if a cleaner exploit is coming.
Operational guidance: Treat the lack of confirmed exploitation as a head start, not a reason to wait. The flaw was found with AI assistance, the fix was rushed out after a leak, and researchers have already reproduced at least one of the bugs. That is the profile of a vulnerability that moves to mass exploitation quickly.
Who's Most Exposed
mod_php deployments come first. Every PHP server stack is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. But PHP rates mod_php highest risk, because its validated exploit runs before any site code, so the site doesn't need a flaw of its own. PHP confirmed full remote code execution over HTTP against mod_php with default settings. Its validation of CVE-2026-109619 on PHP-FPM depends on how the application behaves. If you need to triage, Apache with mod_php goes to the top.
PHP you don't know you're running. CISA notes that PHP is often a component of other software and may not be directly visible. Appliance management consoles, vendor web portals, monitoring tools, and admin utilities such as phpMyAdmin all carry PHP their owners rarely think about. A server inventory that looks only for "web servers" will miss them.
End-of-life installations. One count found roughly 880,000 internet-facing hosts on PHP 8.1 or earlier, which receive no official release. Many are small-business and WordPress sites on shared hosting, legacy internal apps, and contractor-built portals nobody has touched in years.
Your hosting provider may act first. DigitalOcean has notified all customers, is suspending its PHP-based Marketplace images (WordPress, LAMP, LEMP, Laravel) until they are patched, and says it may temporarily restrict traffic to resources showing signs of compromise. Expect other providers to follow. For organizations that rely on hosted sites, an unpatched server may simply go dark.
What to Do
- Inventory first. Find every system running PHP, internet-facing ones first, including appliances, vendor products, containers, and one-click CMS images. On Linux hosts, check both the host and any containers; a single
docker exec <container> php -vacross running containers surfaces the PHP you forgot about. - Verify fixes through vendor advisories, not version numbers. Distribution packages often backport the fix without changing the PHP version number. A patched Ubuntu or RHEL system may still report an older version, and an unpatched one may report a number that looks fine. Check the distribution's security advisory for the package build.
- Patch PHP, then patch the application. Upgrading PHP fixes the interpreter. WordPress, Laravel, and other PHP applications may need their own updates from their maintainers, so confirm both.
- Preserve before you patch exposed systems. For anything that was internet-facing and unpatched, capture web server logs and, where possible, a disk snapshot before updating. Restart PHP services after patching so the fixed code is actually running.
- Take end-of-life PHP offline if it cannot be upgraded or backported right away. CISA and the UK NCSC both recommend this, and it is the right call for federal and contractor systems.
- Treat stopgaps as stopgaps. The PHP Foundation has published measures that block specific attack paths, and Cloudflare's WAF rules cover known vectors for traffic routed through it. Neither makes an installation safe; PHP's maintainers are clear that upgrading is the only fix.
- Hunt. Alert on PHP worker processes (php-fpm, httpd, apache2, lsphp) spawning shells or download tools such as curl and wget, and on new files appearing in web roots.
Summary Status
| CVE | Product | Fixed In | KEV Status | |---|---|---|---| | CVE-2026-109618 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Not yet listed | | CVE-2026-109619 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Not yet listed | | PHP 8.1 and earlier | End-of-life | No official release; source backports for 7.4–8.1; vendor packages vary | Upgrade or take offline |
There is no BOD 26-04 deadline yet. If CISA adds these CVEs to the catalog, we will publish a follow-up with the dates and what changed since this edition. Contractors should not wait for it: an agency customer asking about PHP2Shell next week will want an inventory and a remediation record, not a plan.
Sources: CISA KEV Catalog · PHP Security Announcement · NVD: CVE-2026-109618 · NVD: CVE-2026-109619 · Expel: Php2Shell · Tenable: PHP2Shell FAQ · Help Net Security: PHP2Shell Patched · watchTowr: PHP RCE FAQ · Sherlock Forensics: Preserve Before You Patch
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 22, 2026
AI-Discovered PHP Vulnerabilities Trigger Global Website Outages
Two critical zero-day vulnerabilities in PHP—collectively dubbed "PHP2Shell"—have forced government agencies and major websites across the United States, Europe, and Australia offline as operators race to patch systems. The flaws, designated CVE-2026-109618 and CVE-2026-109619, were reportedly discovered using AI-powered analysis and leaked before official patches were available. Active exploitation began immediately, with VulnCheck reporting attempts sourced from IP addresses in China. The NSA and UK authorities issued warnings about the vulnerabilities affecting PHP, which powers approximately 70% of web servers globally. Multiple government sites, including Australia's Signals Directorate and French government portals, went dark as a precautionary measure while applying emergency patches.
Chinese-Linked Group Conducts AI-Assisted Campaign via ConnectWise Compromise
Microsoft attributed a widespread attack campaign to Chinese-linked threat actors using AI-driven penetration testing tools to compromise ConnectWise, an IT services firm managing systems for hundreds of organizations. The operation employed the ARTEX penetration testing framework combined with AI coding assistants to automate reconnaissance and exploitation. CrowdStrike separately documented four distinct threat groups deploying autonomous AI agents in real-world attacks between May and August 2026, marking a significant evolution in threat actor capabilities. The campaigns demonstrate decision-making and command execution performed by AI agents with minimal human intervention, representing a tactical shift in how sophisticated actors conduct operations at scale.
Active Ransomware Exploitation of Palo Alto VPN Flaw
Qilin and INC ransomware operators are exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect VPN, to gain initial access and steal credentials before deploying ransomware. The flaw enables attackers to bypass authentication mechanisms entirely, providing direct VPN access to target networks. Separately, a threat actor claims to be selling data from 7.7 million Waze users, including personal details and real-time GPS records, on dark web marketplaces, though the claim has not been independently verified.
Sources: NY Post · The Times · Financial Times · GovInfoSecurity · Reuters · Offseq · CXOToday · Hackread
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Salt Typhoon: How China Walked Through America's Wiretap Backdoor — And Why It Is Still Not Fixed
A House Select Committee report from August 2026 found that Chinese state-owned telecom firms maintained equipment and network ties in the U.S. long a...
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Attackers are exploiting critical zero-day vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PHP after details leaked in advance of patches, with...
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
PHP released an out-of-cycle security update for two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale, with government ...
US, allies warn of critical vulnerabilities in programming underlying 70% of the internet
... Cybersecurity and Infrastructure Security Agency — as well as the United Kingdom's National Cyber Security Centre, the Australian Signals ...
Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
Organisations around the world are scrambling to fix a critical cyber-security flaw that could affect millions of websites. The vulnerability is ...
Hackers Steal AI for Cheap Attacks - WSJ
Plus: Anthropic discloses its own cyber risks; Ahold Delhaize supermarket tech restored; billions and billions of attempted hacks.
Hackers steal children's data after company used 'Password1' to protect old account - BBC
The data watchdog reprimanded Ogi Networks Limited and Data Cymru after the 2024 ransomware attack.
Trump's Department of Homeland Security Secretly Ordered Cybersecurity Operatives to ... - Futurism
Under Donald Trump, the Cybersecurity and Infrastructure Security Agency was ordered to acquire and hack a voting machine.
Updated daily