CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two recently patched PHP2Shell vulnerabilities are being actively exploited in the wild, adding them to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws carry a CVSS score of 9.2 and allow unauthenticated remote code execution on affected deployments.
The vulnerabilities are tracked as:
- CVE-2026-109618 — an out-of-memory condition that can be triggered without authentication, according to the available details.
CISA's addition of these issues to the KEV catalog signals that exploitation has been observed rather than merely theoretical, so organizations running affected PHP deployments should treat patching as urgent. The agency has not published additional technical specifics beyond the remote code execution impact and the critical severity rating.
Administrators should review their PHP2Shell installations, apply the vendor patches released for both flaws, and check for signs of compromise on any systems that may have been exposed prior to patching. Given the unauthenticated nature of the attack vector, internet-facing deployments warrant the highest priority.
Source: The Hacker News
Has your organization already applied the patches for these PHP2Shell flaws, or are you still working through exposure assessment?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login