CISA Confirms Active Exploitation of Critical PHP2Shell Remote Code Execution Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two recently patched PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalog, confirming active exploitation. These vulnerabilities, rated 9.2 on CVSS, allow for unauthenticated remote code execution. Federal agencies are mandated to apply fixes by October 29, 2026.