CISA confirms PHP2Shell under attack as researchers clock successful exploits
The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are actively exploiting CVE-2026-109618 and CVE-2026-109619 in PHP implementations. These critical flaws allow unauthenticated remote code execution on vulnerable PHP servers. Successful exploits were documented across honeypots, with attackers using memory exhaustion techniques to achieve shell access before attempting external command execution. Patches became available October 21, but exploitation attempts occurred as early as October 17.
Key points
- CISA confirms active PHP2Shell exploitation in the wild
- Two CVEs rated 9.2, unauthenticated RCE possible
- Federal agencies given until October 29 to patch
- Exploitation documented before public disclosure
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
