CISA Gives Agencies Three Days to Patch PHP2Shell After a Honeypot Caught Working Exploitation
Security / news
CISA Gives Agencies Three Days to Patch PHP2Shell After a Honeypot Caught Working Exploitation
Both PHP flaws (CVE-2026-109618 and CVE-2026-109619) entered the Known Exploited Vulnerabilities catalog on Oct. 26 with an Oct. 29 federal deadline, five days after the fixed releases shipped.
An unauthenticated remote attacker who can send crafted multipart requests to a PHP site can run code on the server, provided the host is on an unpatched PHP branch and a worker process gets reused after a crash. CISA added both PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 26. Federal civilian agencies have until Oct. 29 to fix them.
The catalog's own JSON feed lists both entries with a date added of 2026-10-26 and a due date of 2026-10-29, three days. That is short next to the two weeks CISA gave for the Brotli decoder flaw it listed a day later.
What the fix is, and who has none
PHP shipped emergency releases on Oct. 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. BleepingComputer reports that PHP 8.1 and older receive no upstream update, though source backports exist for 7.4, 8.0 and 8.1 and some distributions and long-term-support vendors carry their own fixes. Varonis says every PHP version back to 5.4 is affected.
| Branch | Fixed release | Upstream status |
|---|---|---|
| 8.5 | 8.5.12 | Fixed Oct. 21 |
| 8.4 | 8.4.27 | Fixed Oct. 21 |
| 8.3 | 8.3.36 | Fixed Oct. 21 |
| 8.2 | 8.2.35 | Fixed Oct. 21 |
| 8.1 and older | None upstream | Backports from vendors only |
Both flaws score 9.2 on CVSS v4.0, per The Hacker News. The score reflects what the vector allows (no account, no user interaction) rather than how easy any one target is to hit. The PHP security team ranks Apache with mod_php as the highest-risk setup, because an exploit can fire before any application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected, so patching a site's own code changes nothing.
What the exploitation evidence shows
Before Oct. 24, the public picture was mostly noise. Dataminr's TRACE team described pre-patch activity as scanning, fingerprinting and non-working exploits with no known compromises, according to BleepingComputer's follow-up. Cloudflare, Hadrian, watchTowr, Previdian and Patchstack saw attempts that failed.
Then Adel Karimi, detection and response lead at Perplexity, reported honeypot evidence on Oct. 24 of working remote code execution against Apache mod_php on PHP 8.4.26. He wrote: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process." Marcus Hutchins, a threat researcher at Expel, called it the highest-quality confirmation of in-the-wild exploitation he had seen.
Karimi limited his own claim. The evidence covers what he called an "intentionally favorable single-worker mod_php profile" and says nothing about reliability against other worker counts, PHP builds or applications. Cloudflare's CTO, Dane Knecht, separately said the company saw early attacks on both flaws before the patches shipped, and described its WAF rules as temporary.
- PHP2Shell (CVE-2026-109618, CVE-2026-109619)3 days
- Brotli (CVE-2026-111497)14 days
Source: CISA Known Exploited Vulnerabilities catalog JSON feed, accessed 2026-10-29
What operators should do
CISA's alert, published Oct. 21 and revised Oct. 26, tells organisations to inventory every system running any PHP, including PHP embedded in other software, and to patch internet-facing hosts first. Anyone on PHP 8.1 or earlier who cannot patch should take the system offline, the alert says. The agency also points to a SIGMA detection rule that looks for PHP worker processes launching shells or downloading tools.
Varonis adds detection signals: malformed multipart uploads followed by memory-limit errors or bursts of HTTP 500 responses, and oversized PHPSESSID cookies in responses. Because the bug can leak worker memory, it advises rotating secrets on exposed servers. VirusTotal estimates more than 5.1 million PHP hosts are reachable online, about 3.8 million with at least one open port.
Interim settings do not fully protect, BleepingComputer notes: session.upload_progress.enabled=0 for CVE-2026-109619, and memory_limit=-1 with a low post_max_size for CVE-2026-109618. A third PHP bug, CVE-2026-115560, is not fixed by any of the October 21 releases. The next date to watch is Oct. 29, when the federal deadline lapses.
Elsewhere in this month's patch queue, see our reports on Oracle E-Business Suite probing and the unpatched UEFI flaw in EDK II.
Sources
More in Security
- 01A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 02Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 03Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 04KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.