--- title: CISA confirms attackers are exploiting both PHP2Shell flaws description: CISA has added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue, giving federal agencies until Thursday, October 29, to patch... canonical: https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA confirms attackers are exploiting both PHP2Shell flaws | daily.dev og:description: CISA has added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue, giving federal agencies until Thursday, October 29, to patch... og:url: https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls og:image: https://api.daily.dev/og/posts/7CvPW3RLs.png og:image:alt: CISA confirms attackers are exploiting both PHP2Shell flaws og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA confirms attackers are exploiting both PHP2Shell flaws **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary CISA has added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue, giving federal agencies until Thursday, October 29, to patch CVE-2026-109618 and CVE-2026-109619. Perplexity's honeypots recorded 35 shell commands against PHP 8.4.26 servers running mod_php, matching the evidence for CVE-2026-109618. Separately, Israeli firm Dream claims attackers chained PHP2Shell with a Linux kernel flaw (Fragnesia, CVE-2026-46300) to root 25 servers, including a US government-affiliated environment, though it hasn't been independently verified. A Delft University dashboard has logged 68,499 exploitation requests from 652 IPs across 73 countries since October 21. PHP patched both flaws on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What PHP versions fix the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619? PHP fixed both flaws on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team says risk is highest for servers running mod_php under Apache, and that there are no complete mitigations for systems that cannot update immediately, so CISA recommends taking unpatched systems offline. _Teams racing to patch PHP2Shell can track emerging exploitation details and fixes on daily.dev._ ### Is there confirmed evidence that the PHP2Shell flaws are being actively exploited? Yes, honeypots run by Perplexity's detection and response lead recorded 35 shell commands against PHP 8.4.26 servers running mod_php on October 24, matching CVE-2026-109618. Security researcher Marcus Hutchins called it the highest quality confirmation of in-the-wild exploitation seen so far, though earlier claims from Sophos and Palo Alto Networks about successful breaches were later withdrawn or corrected. _Developers deciding how urgently to patch can follow verified exploitation reports for PHP2Shell on daily.dev._ ### What is the Fragnesia vulnerability CVE-2026-46300 and how does it relate to PHP2Shell attacks? Fragnesia, tracked as CVE-2026-46300, is a Linux kernel flaw that can give an attacker root access. Security firm Dream reported attackers chaining it with PHP2Shell to root 25 servers, including systems in a US government-affiliated environment, decrypting an LDAP service account password and enumerating domain users and groups, though the findings have not been independently verified. _Infra teams assessing kernel-plus-web exploit chains can keep up with cases like Fragnesia on daily.dev._ ## Similar posts on daily.dev - [CISA confirms PHP2Shell under attack as researchers clock successful exploits](https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2) · The Register · 0 upvotes · 0 comments - [Websites offline. The internet is on fire. Obviously, we were unprepared.](https://daily.dev/posts/websites-offline-the-internet-is-on-fire-obviously-we-were-unprepared--hv1iepv7z) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA confirms attackers are exploiting both PHP2Shell flaws","url":"https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls"},"datePublished":"2026-10-28T14:36:16.002Z","dateModified":"2026-10-28T15:58:35.772Z","description":"CISA has added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue, giving federal agencies until Thursday, October 29, to patch...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b3611a92ba8062a28139b28fbc829f77?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b3611a92ba8062a28139b28fbc829f77?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,php","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"CISA confirms attackers are exploiting both PHP2Shell flaws"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-confirms-attackers-are-exploiting-both-php2shell-flaws-7cvpw3rls#faq","mainEntity":[{"@type":"Question","name":"What PHP versions fix the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619?","acceptedAnswer":{"@type":"Answer","text":"PHP fixed both flaws on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team says risk is highest for servers running mod_php under Apache, and that there are no complete mitigations for systems that cannot update immediately, so CISA recommends taking unpatched systems offline. Teams racing to patch PHP2Shell can track emerging exploitation details and fixes on daily.dev."}},{"@type":"Question","name":"Is there confirmed evidence that the PHP2Shell flaws are being actively exploited?","acceptedAnswer":{"@type":"Answer","text":"Yes, honeypots run by Perplexity's detection and response lead recorded 35 shell commands against PHP 8.4.26 servers running mod_php on October 24, matching CVE-2026-109618. Security researcher Marcus Hutchins called it the highest quality confirmation of in-the-wild exploitation seen so far, though earlier claims from Sophos and Palo Alto Networks about successful breaches were later withdrawn or corrected. Developers deciding how urgently to patch can follow verified exploitation reports for PHP2Shell on daily.dev."}},{"@type":"Question","name":"What is the Fragnesia vulnerability CVE-2026-46300 and how does it relate to PHP2Shell attacks?","acceptedAnswer":{"@type":"Answer","text":"Fragnesia, tracked as CVE-2026-46300, is a Linux kernel flaw that can give an attacker root access. Security firm Dream reported attackers chaining it with PHP2Shell to root 25 servers, including systems in a US government-affiliated environment, decrypting an LDAP service account password and enumerating domain users and groups, though the findings have not been independently verified. Infra teams assessing kernel-plus-web exploit chains can keep up with cases like Fragnesia on daily.dev."}}]} ```