CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA Adds PHP2Shell Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.

The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments -

• CVE-2026-109618 - An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
• CVE-2026-109619 - A stale internal request-state vulnerability that allows for unauthenticated remote code execution.

The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said. "The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload."

"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications."

Patched Versions and Exposure

The issues have been addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released on October 21, 2026. Federal agencies have time until October 29, 2026, to apply the necessary fixes.

PHP, short for PHP: Hypertext Preprocessor, is a server-side scripting language used in roughly 70% of all websites on the internet. According to estimates shared by Censys, more than 32.51 million PHP services are still running an affected version.

The severity of the vulnerabilities has prompted numerous advisories from software and security vendors and government agencies across the world, including -

• ABB
• Arista Networks
• Belden
• Broadcom
• Canon
• Citrix
• Craft CMS
• Dell
• Dormakaba
• Drupal
• ExpressionEngine
• F5
• Hikvision
• HP
• HPE
• Hitachi Energy
• HMS Networks
• Huawei
• IBM
• Ivanti
• Johnson Controls
• Mitel
• Moxa
• NETGEAR
• October CMS
• Okta
• QNAP
• Rockwell Automation
• Ruckus Wireless
• Salesforce
• Schneider Electric
• Siemens (1), (2)
• SonicWall
• Splunk
• Synology
• Veeam
• Wibu-Systems
• WordPress

Brotli Decoder Flaw in Windows Builds

As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could also result in privilege escalation and unauthenticated remote code execution.

The vulnerability, also known as Broccoli2Shell, HTTP2Shell, and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with other projects that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.

"In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled," the PHP Foundation said. "This is disabled by default in cURL, but applications and HTTP client libraries can enable it."