CISA Warns of Active Exploitation in Critical PHP2Shell Vulnerabilities

CISA has confirmed active exploitation of two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, adding them to its KEV catalog. These flaws, rated 9.2 CVSS, enable unauthenticated remote code execution on affected PHP deployments. Researchers confirmed successful exploits on October 24, 2026. Federal agencies must apply fixes by October 29, 2026, as PHP powers approximately 70% of websites, with millions of services still vulnerable.