CISA confirms attackers are exploiting both PHP2Shell flaws
The US Cybersecurity and Infrastructure Security Agency confirmed that attackers are actively exploiting two PHP2Shell flaws and added them to its Known Exploited Vulnerabilities catalog. Federal civilian agencies have been given until October 29 to remediate the vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. The inclusion indicates these are actively weaponized threats in the wild.
Key points
- CISA confirms active exploitation of two PHP2Shell vulnerabilities
- Federal deadline for remediation: October 29
- CVE-2026-109618 and CVE-2026-109619 added to Known Exploited list
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Next Web did the reporting; read the original for the full story.
Read the full story at The Next Web
