PHP2Shell went on CISA's exploited list on 26 October. Agencies get three days.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Monday 26 October 2026, CISA added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, with a federal deadline of 29 October. Both allow remote code execution with no login. SecurityWeek reports a researcher's honeypots running PHP 8.4.26 under Apache mod_php saw 35 shells launched on 24 October.
Why it matters
The patch shipped on 21 October. Working shells were on record three days later. And CISA warns PHP is often embedded inside other software, so the box you forgot about is the one still answering.
What to do
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, internet-facing servers first. If you still run PHP 8.1 or older, CISA says take those systems offline until they are patched.
My take
Lior Aharonov
Founder, 7IT Solutions
A patch you haven't installed is just a press release. The attackers already read it.
Sources
Researched with AI tools; every fact is checked against the linked sources.