CISA adds both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its exploited-vulnerabilities list and gives federal agencies until Oct 29, with forensic triage required
CISA added the two PHP remote code execution flaws to the Known Exploited Vulnerabilities catalog on Oct 26 and updated its Oct 21 alert, "Critical Vulnerabilities in PHP Require Immediate Patching". Both entries describe unauthenticated remote code execution in PHP: CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state).
- Deadline: federal civilian agencies must mitigate by Oct 29, 2026, three days after listing, under BOD 26-04.
- Forensic triage: both entries are flagged for CISA's forensics triage requirements, meaning agencies must also check whether servers were compromised before they were patched, not just patch.
- Ransomware use: listed as unknown.
This follows confirmed successful exploitation on honeypots (Oct 24) and Amazon's report of attempts since Oct 17. What to do: move every PHP 8.2 to 8.5 install to the fixed release, restart PHP-FPM and other worker processes so the new binary actually runs, and hunt for signs of earlier compromise on anything that was internet-facing before you patched (see the PHP2Shell hunt).
Sources: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26) · CISA Known Exploited Vulnerabilities Catalog · CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, updated Oct 26)