CISA Orders 3-Day Patch for Critical PHP2Shell Vulnerabilities

Urgent Federal Mandate for PHP Patching

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring federal civilian agencies to patch critical vulnerabilities in the PHP web programming language within three days. The agency added two specific flaws, identified as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog on Monday. This classification carries a strict deadline of October 29, 2026, for compliance. The move marks a significant escalation from earlier warnings, as CISA previously stated it had not yet observed successful exploitation in the wild. The confirmation of active attacks underscores the immediate threat posed by these flaws to government infrastructure.

Critical Severity and Unauthenticated Access

The vulnerabilities, collectively referred to as PHP2Shell, have been assigned a severity score of 9.2 on the Common Vulnerability Scoring System (CVSS) scale. This high rating reflects the ease with which attackers can exploit the bugs without requiring authentication. The flaws allow malicious actors to execute arbitrary code on vulnerable PHP servers remotely. Given that PHP is estimated to power approximately 70% of web-facing servers globally, the potential impact is widespread. The unauthenticated nature of the exploit means that any server running the affected versions of PHP is potentially accessible to attackers without prior login credentials or valid sessions.

Timeline of Exploitation and Disclosure

Evidence suggests that threat actors began targeting these vulnerabilities before the public release of patches. Amazon Web Services (AWS) detected attempts to exploit the flaws as early as October 17, 2026. This discovery occurred four days before the vulnerabilities were publicly disclosed and before maintainers released fixes on October 21. Despite the rapid response from developers, attackers had already developed working exploits. The gap between initial detection by cloud providers and public disclosure highlights the speed at which these vulnerabilities can be weaponized. Security researchers note that while developing a working exploit was initially challenging, it proved possible for attackers to bypass defenses.

Documented Successful Attacks

Concrete evidence of active exploitation was provided by Adel Karimi, a security researcher at Perplexity. On October 24, Karimi recorded 35 successful shell executions across three honeypots running PHP version 8.4.26 under Apache mod_php. The attacks originated from two distinct IP addresses and utilized techniques involving memory exhaustion and information disclosure to achieve remote code execution. Following initial access, attackers attempted to contact external servers using PHP, curl, and wg commands. These findings confirm that the vulnerabilities are not merely theoretical but are being actively used to compromise systems in real-world scenarios.

Global Impact and Industry Response

The confirmation of active exploitation has intensified pressure on organizations worldwide to remediate their systems. While the CISA directive specifically targets US federal civilian agencies, the nature of the vulnerability affects any organization using PHP. Some governments and large corporations have already taken proactive measures, such as taking sites offline temporarily to apply fixes. The widespread reliance on PHP means that the window for patching is critical. Failure to update systems by the deadline could result in significant data breaches, service disruptions, and unauthorized access to sensitive information. The situation remains fluid as attackers continue to refine their methods against unpatched servers.

Key takeaways

• CISA mandates that US federal civilian agencies patch PHP vulnerabilities by October 29, 2026.
• CVE-2026-109618 and CVE-2026-109619 are rated 9.2 and allow unauthenticated remote code execution.
• Researcher Adel Karimi documented 35 successful exploits on October 24, confirming active in-the-wild attacks.
• AWS detected exploitation attempts on October 17, prior to the public patch release on October 21.
• PHP powers roughly 70% of web servers, posing a significant global security risk if unpatched.