CISA Orders Federal PHP2Shell Fixes by October 29 After Exploits Surface

The federal government now treats the PHP2Shell flaws as active threats, and that changes the urgency for every PHP operator. On Monday, October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must remediate by October 29, two days from now, and the PHP release from October 21 is the fix they need to install.

Both flaws sit in PHP, the open-source language behind many public websites. CVE-2026-109618 is a memory corruption flaw, and CVE-2026-109619 is a stale internal request-state flaw. Both allow unauthenticated remote code execution, and both are rated 9.2 on CVSS version 4.0, according to The Hacker News and WindowsForum.

Why the KEV listing changes the PHP2Shell picture

Until this week, CISA's own alert said the agency had not observed successful exploitation in the wild. The October 26 update reversed that position by adding both CVEs to the catalog. KEV listings are built on evidence that attackers are actively using a flaw, so the listing is a stronger signal than a vendor advisory.

The catalog also works as a priority list. Under Binding Operational Directive 26-04, federal agencies must prioritize KEV entries on exposed assets that give attackers full control. CISA encourages private organizations to follow the same approach, which gives any company running PHP a clear benchmark for how fast to act.

The trigger came from outside research. Adel Karimi, detection and response lead at Perplexity, reported successful remote code execution against honeypot systems on October 24. Karimi said of the results, according to The Hacker News: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process." That report prompted CISA's action.

PHP2Shell CVE-2026-109618 patch: which versions fix it

PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The older branches are where teams get caught, so the table below shows where each branch stands.

For anyone on the older branches, the message is blunt. A backport is not the same as a supported upgrade. Tenable's FAQ notes that PHP calls updating the only complete fix, so moving to a fixed release is the real path forward (Tenable).

Which PHP setups face the most risk

CISA says the flaws affect all PHP installations that serve web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. According to PHP, Apache mod_php is the highest-risk configuration, so administrators running it should move first.

Exploitation is harder than the headline score implies. Red Hat says reliable exploitation of CVE-2026-109618 requires precise heap manipulation and timing. Standard Red Hat Enterprise Linux deployments that use PHP-FPM make that harder, because workers exit on early initialization failures (WindowsForum). Vendor guidance does not fully agree on whether PHP-FPM faces the same level of risk as mod_php, so the safe reading is to patch every web-facing configuration.

The exposed group is wide. Small businesses with PHP content sites, hosting providers running shared servers, government agencies and developers with self-hosted projects all fall in scope. Any U.S. organization running PHP on a public web server should treat itself as affected until it has checked.

What attackers have done so far

The public record of exploitation is thin, and the details matter. Amazon Threat Intelligence logged an exploitation attempt on October 17, four days before public disclosure on October 21. Karimi's honeypot results followed on October 24.

Unit 42 published a suspected compromise on October 23 and withdrew it two days later. The firm said it could not link the initial access to the PHP2Shell CVEs. No source with direct evidence has publicly confirmed a successful compromise, and public attribution to a named threat actor remains unclear.

Other telemetry looks quieter. Tanium's write-up notes that Patchstack data shows mostly probing so far (Tanium). USA 24 has also reported that a suspected North Korean group scanned 216 PHP servers for PHP2Shell flaws, which suggests reconnaissance is already underway even if confirmed intrusions are scarce.

How to check and patch PHP servers this week

• Check the PHP version on every internet-facing server, and confirm the version your web server actually loads, not only the command-line binary.
• Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch.
• Restart PHP-FPM and web server workers so the new binary loads, as Tanium recommends (Tanium).
• If an upgrade cannot happen right away, set session.upload_progress.enabled=0. That blocks only one path to CVE-2026-109619 and does nothing for CVE-2026-109618, so treat it as a stopgap.
• Take offline any system on PHP 8.1 or older that cannot be updated until it is patched or upgraded. SOCRadar attributes this step to CISA's recommendation (SOCRadar).

Shared hosting customers should also ask their provider, in writing, which PHP version the account runs and when it will be patched. Waiting for a provider to act without a date is the most common way small sites stay exposed.

What comes next for PHP and the October 29 deadline

The federal deadline falls on Thursday, October 29. Agencies will either show compliance or explain gaps, and that will reveal how many federal sites were still on unpatched branches.

Three things are worth watching. The first is whether public exploit code appears, since reliable exploits are scarce today. The second is whether PHP ships fuller fixes for the 7.4 through 8.1 branches. The third is whether honeypot activity turns into confirmed compromises, which would push the story from research to incident response.

The pattern is familiar. Ransomware gangs have already exploited a Palo Alto Networks GlobalProtect VPN flaw that was patched in May. A fix only protects systems that have actually received it, and PHP servers that sit unpatched past October 29 will be the next easy targets.