Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: October 27, 2026
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 26, 2026
CISA added both PHP2Shell vulnerabilities to the KEV catalog on October 26, with a remediation deadline of October 29, this Thursday. Readers of our two KEV Watch editions have had nearly a week of lead time. For everyone else, the deadline arrives fast, and the more pressing problem is that exploitation began long before the listing. Any internet-facing PHP system that went unpatched last week should be treated as a candidate for compromise, not just a patching ticket.
What Changed: From Attempts to Confirmed Exploitation
Last Friday, CISA's alert said it had "not observed successful exploitation." The KEV listing means that has changed. CISA has not published the evidence behind the listing, but third-party reporting describes the scale of the activity that preceded it.
Mass exploitation started almost immediately. Cloudflare researchers reported tens of thousands of exploitation attempts within the first 45 minutes after disclosure, hundreds of thousands within two hours, and millions by October 22. Whatever the success rate, the volume means virtually every exposed PHP server has already been tested.
At least one organized campaign is working through a target list. Threat intelligence firm Cyfirma reports a group it suspects is linked to North Korea, coordinating over a private I2P channel it has monitored since October 22. On October 24, the operators reported 216 unpatched or partially mitigated hosts and named 21 scanning nodes, with about a third of the targets checked at that point. The same addresses were seen running web-shell tooling and upload-progress session-poisoning attempts. The attribution comes from a single vendor and should be treated as an assessment, but the tradecraft details are useful to defenders regardless of who is behind them.
The scanning is built to stay quiet. Cyfirma describes slow, low-volume scanning from rotating machines, with any node that hits filtering or rate limiting retired. Rate-based alerting is unlikely to catch it. Organizations that judged their exposure by the absence of noisy alerts last week should not take comfort from that.
Operational guidance: Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or verify the fix through your distribution's security advisory, and restart PHP services so the patched code is running. Systems on PHP 8.1 or earlier, which receive no official fix, should be taken offline until upgraded or patched through a vendor backport.
Assume Compromise Where the Window Was Open
With exploitation running at this scale since October 21, patching alone does not settle the question for any system that was exposed and unpatched during that period. Patch first, but preserve logs before you do, and then hunt.
- Web shells. Check web roots and upload directories for PHP files created or modified since October 21, especially in paths your application doesn't normally write to.
- Upload-progress session poisoning. This is the technique the public proof-of-concept relies on, and it matches activity reported in the wild. Review requests carrying upload-progress fields and unexpected session files.
- Process behavior. Alert on PHP worker processes (php-fpm, httpd, apache2, lsphp) spawning shells or download tools such as curl and wget. CISA's SIGMA rule, published in its SIGMA Rules GitHub repository, covers this ground and is the fastest way to get detection running.
- Low-and-slow requests. Because the scanning deliberately avoids rate thresholds, search logs for the request patterns themselves rather than spikes in volume.
If you find evidence of compromise, rebuilding from a known-good state is safer than cleaning in place: web shells are cheap to plant in multiple locations, and credentials stored on the server, such as database passwords and API keys, should be rotated.
Operational guidance: For federal agencies and contractors, document each internet-facing PHP system with two answers: when it was patched, and what the hunt found. A system that was exposed from October 21 until the patch should be recorded as a compromise assessment under BOD 26-04, not closed as a routine update. Expect agency customers to ask for exactly that record.
Summary Deadline Status
| CVE | Product | Fixed In | KEV Added | Deadline | |---|---|---|---|---| | CVE-2026-109618 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 26 | Oct 29 | | CVE-2026-109619 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 26 | Oct 29 |
Both entries are due Thursday. PHP 8.1 and earlier have no official fix, so for those systems the only compliant paths are an upgrade, a vendor-backported package, or discontinuing use.
Sources: CISA: Two KEV Additions (Oct 26) · CISA Alert: Critical Vulnerabilities in PHP · CISA KEV Catalog · PHP Security Advisory · Security Affairs: CISA Adds PHP2Shell to KEV · CISA SIGMA Rules Repository · SOCRadar: PHP2Shell · Tenable: PHP2Shell FAQ
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 28, 2026
South Korean Financial Sector Hit by Coordinated Intrusion Campaign
South Korean financial institutions including cryptocurrency exchange Bithumb and multiple securities firms experienced data breaches in what regulators described as a widespread wave of intrusions, according to statements from the Financial Supervisory Service. Bithumb confirmed that attackers compromised its in-house mobile system, leading to personal information leakage. The FSS Governor acknowledged that "major financial investment companies experienced overall hacking incidents," though the number of affected organizations, scope of data exposure, and whether the intrusions share common infrastructure or tradecraft have not been disclosed. Reuters reports that three firms confirmed breaches, while Korean media indicates the incidents extend beyond banking into securities and asset management sectors. The coordinated timing and industry targeting suggest an organized campaign, though attribution and operational details remain under investigation.
Widespread Exploitation Activity Targets Unpatched Infrastructure
Researchers report active exploitation of multiple vulnerabilities across enterprise and e-commerce platforms. A credit card skimming operation compromised a shared analytics script used by e-commerce platform Convertr to steal payment card data from customers, according to Bleeping Computer. The supply chain compromise allowed attackers to harvest credentials across multiple storefronts relying on the shared script. Separately, a working exploit for an unpatched Linux kernel privilege escalation vulnerability (ZDI-CAN-33367) was publicly released before receiving a CVE identifier or upstream fix, allowing unprivileged users to modify read-only files in memory. The Federal Election Commission experienced a hacking attempt causing site outages, though officials stated the incident is not expected to impact ballot casting—only potential disruption to campaign finance data analysis. Meanwhile, Japanese foreign exchange provider GMO Internet offered up to $1 million for information leading to arrests following its Desktop Cloud breach, though the company has not confirmed whether the threatened follow-up ransomware attack materialized. In sentencing news, Ukrainian national Artem Stryzhak received 70 months for conspiracy to commit computer fraud in connection with ransomware attacks against hospitals, government entities, and businesses.
Sources: Reuters · CoinDesk · Chosun · Bleeping Computer · Channel E2E · Shacknews · The Hacker News · Justice.gov
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
U.S. authorities seized seven domains used by China-linked Flax Typhoon to scan networks and support intrusions into critical infrastructure worldwide...
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was ...
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important." Cybersecurity. On Android, Authenticator .....
Ambulance Traffic Diverted, Clinical Appointments Cancelled and Classes Cancelled Due to ...
The University of New Mexico Health System is experiencing a cybersecurity issue at this time. UNM Health officials are actively working to ...
South Carolina launches program to protect rural hospitals from cybersecurity attacks
Project Lifeline 250 will help rural hospitals identify cybersecurity risks, strengthen their defenses and restore critical systems after an ...
Critical PHP flaws could let hackers take over church websites
Congregations are urged to act now, even if someone else manages their site. Two critical security vulnerabilities in PHP, the programming ...
PHP Vulnerability Exploits Spark 'Black October' Cybersecurity Surge
With AI-driven hacking and large-scale cyberattacks surging this month, the cybersecurity industry has coined the term “black October.” According to ....
Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)
Ransomware operators including Qilin and INC are actively exploiting PAN-OS vulnerability CVE-2026-0257 to bypass authentication and gain unauthorized...
Updated daily