The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially confirmed the active exploitation of two critical PHP vulnerabilities, designated PHP2Shell.
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday. This action mandates that federal civilian agencies must address these flaws by October 29.
Both vulnerabilities carry a CVSS rating of 9.2 and permit code execution on vulnerable PHP servers without requiring authentication.
This confirmation follows a shift from last week, when the agency only issued a warning regarding the danger of PHP2Shell without observing confirmed in-the-wild exploitation.
Adel Karimi, a security researcher at Perplexity, recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php on October 24. These attacks originated from two IP addresses and leveraged memory exhaustion and disclosure for remote code execution.
Delft University's Threat Intelligence Lab has tracked over 50,000 PHP2Shell exploitation requests originating from more than 600 IP addresses spanning 70 countries. Of these, 171 addresses proceeded beyond probing to send exploit code or malware droppers.
Furthermore, CISA noted that threat actors could chain the PHP2Shell flaws with CVE-2026-46300, a Linux kernel privilege escalation bug known as Fragnesia. This chaining allows attackers to implant PHP webshells and execute commands as root.
Dream Security analysts reported in a Monday document that this attack operation included a custom weaponization of the PHP2Shell exploit chain paired with the Fragnesia kernel privilege escalation, resulting in the rooting of 25 servers across the United States, Japan, Taiwan, and South Korea.
This development underscores the operational risk posed by software dependencies, as PHP powers approximately 70% of all websites, with VirusTotal estimates showing over 5.1 million PHP hosts exposed online.
CISA's designation confirms the agency views both vulnerabilities as actively exploited, although it has not disclosed specific compromised organizations. This situation highlights the urgent need for platform operators to prioritize remediation, as patches were released on October 21, but attackers were already active.
