The U.S. Cybersecurity and Infrastructure Security Agency has listed two critical PHP vulnerabilities under the collective name PHP2Shell in its catalog of security flaws undergoing active exploitation. Unauthenticated attackers can leverage these two issues—CVE-2026-109618 and CVE-2026-109619—in sophisticated attack chains to achieve remote code execution on systems running unpatched versions.

On Wednesday, October 21, the PHP security team released patches addressing both flaws, just one day after urging administrators to deploy updates immediately upon release. Despite early disclosure of technical details and proof-of-concept code circulating online before patches shipped, the PHP team stated that no working exploits existed at that time.

Security vendors including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack all observed widespread exploitation attempts in the wild prior to public announcement, though they characterized these attempts as unsuccessful. Amazon's threat intelligence division noted that attackers began probing for PHP2Shell vulnerabilities four days before the security patches became available.

Federal agencies ordered to patch by Thursday

CISA added the two vulnerabilities to its Known Exploited Vulnerabilities Catalog on Monday and issued a directive requiring Federal Civilian Executive Branch agencies to remediate their systems by Thursday under Binding Operational Directive 26-04. The agency stated that "these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."

While the directive applies specifically to FCEB agencies, CISA urged all organizations to "adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

Perplexity's detection and response lead Adel Karimi confirmed active exploitation in the wild over the weekend after the company's honeypots captured evidence of remote code execution targeting an Apache mod_php installation running PHP 8.4.26. CISA has not yet released additional details regarding ongoing PHP2Shell attack campaigns.

On Friday, the PHP security team also disclosed mitigation guidance for a separate remote code execution vulnerability, CVE-2026-115560, which currently has no patch available. This flaw can be exploited when systems run "with an unusual combination of configuration and application code."

PHP underpins approximately 70% of all websites globally. According to VirusTotal data, more than 5.1 million PHP hosts are publicly accessible online, with roughly 3.8 million instances exposing at least one port to potential attack.