Critical PHP Vulnerabilities (PHP2Shell) Under Active Exploitation, CISA Issues Alert

Two critical vulnerabilities in the core PHP language runtime, identified as CVE-2026-109618 and CVE-2026-109619, have been disclosed and are now under active exploitation. These flaws, collectively referred to as PHP2Shell, enable unauthenticated remote code execution and memory disclosure. Security researchers have confirmed successful exploitation against honeypot systems, demonstrating the severity of these issues. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply fixes by October 29, 2026. This development is critical for any organization running PHP-based web applications, which constitutes a significant portion of the internet. The ability for attackers to achieve remote code execution without authentication means that vulnerable systems can be compromised with minimal effort, leading to data theft, malware installation, or further network penetration. The immediate inclusion in CISA's KEV catalog underscores the high likelihood of widespread exploitation and the severe impact these vulnerabilities can have on an organization's security posture. The timing of these disclosures, amidst a surge of other cyber incidents, has led some in the industry to label the current period as "Black October." These PHP vulnerabilities fit into a broader trend of increasingly sophisticated and rapidly exploited software flaws. The shrinking time between vulnerability disclosure and active exploitation is a persistent challenge for defenders. Furthermore, the use of AI by attackers to accelerate their activities, as noted in recent threat reports, exacerbates this problem by lowering the barrier to entry for cybercriminals and enabling faster, more scalable attacks. This incident also highlights the ongoing risk associated with end-of-life software, as PHP versions 8.1 and earlier will not receive patches, leaving many systems permanently vulnerable if not upgraded. Practitioners must prioritize immediate patching of all affected PHP installations to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. For systems that cannot be patched immediately, organizations should consider implementing temporary mitigations such as blocking multi-part file uploads, though this may impact application functionality. It is also crucial to monitor web server logs for suspicious activity, particularly POST requests containing `PHP_SESSION_UPLOAD_PROGRESS` strings, and to check for unexpected process execution or file modifications on web application servers. Organizations should leverage security tools like Cloud Armor for managed rule protections and vulnerability assessment tools to identify vulnerable PHP versions across their infrastructure. The urgency of this situation cannot be overstated; proactive and immediate action is essential to prevent potential breaches.