---
title: CISA adds both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its exploited-vulnerabilities list and gives federal agencies until Oct 29, with forensic triage required | ctxsec
url: https://ctxsec.com/items/cisa-kev-php2shell-cve-2026-109618-109619-due-oct-29
description: ""
status: "official (CISA KEV, added Oct 26; federal due date Oct 29)"
published: 2026-10-26
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cisa-kev-php2shell-cve-2026-109618-109619-due-oct-29.md)

official (CISA KEV, added Oct 26; federal due date Oct 29)

2026-10-26

### CISA adds both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its exploited-vulnerabilities list and gives federal agencies until Oct 29, with forensic triage required

CISA added the two PHP remote code execution flaws to the **Known Exploited Vulnerabilities** catalog on **Oct 26** and updated its Oct 21 alert, "Critical Vulnerabilities in PHP Require Immediate Patching". Both entries describe unauthenticated remote code execution in PHP: **CVE-2026-109618** (memory corruption) and **CVE-2026-109619** (stale internal request state).

- **Deadline:** federal civilian agencies must mitigate by **Oct 29, 2026**, three days after listing, under BOD 26-04.
- **Forensic triage:** both entries are flagged for CISA's forensics triage requirements, meaning agencies must also check whether servers were compromised before they were patched, not just patch.
- **Ransomware use:** listed as unknown.

This follows confirmed successful exploitation on honeypots ([Oct 24](/items/php2shell-first-confirmed-itw-rce-honeypots-oct-24)) and Amazon's report of attempts since Oct 17. **What to do:** move every PHP 8.2 to 8.5 install to the fixed release, restart PHP-FPM and other worker processes so the new binary actually runs, and hunt for signs of earlier compromise on anything that was internet-facing before you patched (see the [PHP2Shell hunt](/items/hunt-php2shell-successful-chain-four-stage-fingerprint)).

Sources: [CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 26)](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, updated Oct 26)](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)