--- title: CISA confirms PHP2Shell under attack as researchers... description: CISA confirmed active exploitation of two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, adding them to its Known Exploited... canonical: https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA confirms PHP2Shell under attack as researchers clock successful exploits | daily.dev og:description: CISA confirmed active exploitation of two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, adding them to its Known Exploited... og:url: https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2 og:image: https://api.daily.dev/og/posts/lrLasK0g2.png og:image:alt: CISA confirms PHP2Shell under attack as researchers clock successful exploits og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA confirms PHP2Shell under attack as researchers clock successful exploits **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary CISA confirmed active exploitation of two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, adding them to its Known Exploited Vulnerabilities catalog with an October 29 patch deadline for federal agencies. Both flaws score 9.2 on the CVSS scale and allow unauthenticated remote code execution. AWS saw exploitation attempts as early as October 17, four days before public disclosure. Perplexity researcher Adel Karimi recorded 35 successful shell executions across honeypots running PHP 8.4.26. Delft University's Threat Intelligence Lab tracked more than 50,000 exploitation requests from over 600 IP addresses. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which PHP versions fix the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619? Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Both vulnerabilities are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution on vulnerable PHP servers. Patches landed on October 21, though attackers had already begun exploiting the flaws as early as October 17, four days before public disclosure. _Teams patching PHP servers against active exploits can track fast-moving vulnerability coverage on daily.dev._ ### Is PHP2Shell actually being exploited in the wild or just scanned for? Yes, CISA confirmed successful exploitation after adding both flaws to its Known Exploited Vulnerabilities catalog. Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php, using memory exhaustion and disclosure techniques. Delft University's Threat Intelligence Lab tracked over 50,000 exploitation requests, with 171 IP addresses sending actual exploit code or malware droppers rather than just probing. _Security engineers verifying exploitation claims before escalating patches can follow confirmed updates on daily.dev._ ### Why did Sophos and Palo Alto Networks retract their PHP2Shell breach claims? Sophos walked back its initial assessment after determining the activity it had observed amounted only to scanning and failed exploitation attempts, not successful breaches. Palo Alto Networks withdrew claims linking the PHP2Shell vulnerabilities to an intrusion at a European government agency. These retractions came before CISA's own confirmation that exploitation was occurring elsewhere. _Developers sorting confirmed threats from retracted reports can track verified security news on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA confirms PHP2Shell under attack as researchers clock successful exploits","url":"https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2"},"datePublished":"2026-10-27T14:49:46.182Z","dateModified":"2026-10-27T14:50:34.912Z","description":"CISA confirmed active exploitation of two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, adding them to its Known Exploited...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da7b04537f7956d32bf309ffaa5d34dd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da7b04537f7956d32bf309ffaa5d34dd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"CISA confirms PHP2Shell under attack as researchers clock successful exploits"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits-lrlask0g2#faq","mainEntity":[{"@type":"Question","name":"Which PHP versions fix the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619?","acceptedAnswer":{"@type":"Answer","text":"Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Both vulnerabilities are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution on vulnerable PHP servers. Patches landed on October 21, though attackers had already begun exploiting the flaws as early as October 17, four days before public disclosure. Teams patching PHP servers against active exploits can track fast-moving vulnerability coverage on daily.dev."}},{"@type":"Question","name":"Is PHP2Shell actually being exploited in the wild or just scanned for?","acceptedAnswer":{"@type":"Answer","text":"Yes, CISA confirmed successful exploitation after adding both flaws to its Known Exploited Vulnerabilities catalog. Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php, using memory exhaustion and disclosure techniques. Delft University's Threat Intelligence Lab tracked over 50,000 exploitation requests, with 171 IP addresses sending actual exploit code or malware droppers rather than just probing. Security engineers verifying exploitation claims before escalating patches can follow confirmed updates on daily.dev."}},{"@type":"Question","name":"Why did Sophos and Palo Alto Networks retract their PHP2Shell breach claims?","acceptedAnswer":{"@type":"Answer","text":"Sophos walked back its initial assessment after determining the activity it had observed amounted only to scanning and failed exploitation attempts, not successful breaches. Palo Alto Networks withdrew claims linking the PHP2Shell vulnerabilities to an intrusion at a European government agency. These retractions came before CISA's own confirmation that exploitation was occurring elsewhere. Developers sorting confirmed threats from retracted reports can track verified security news on daily.dev."}}]} ```