The Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, following verified reports that attackers are now successfully hijacking servers. The flaws, collectively nicknamed “PHP2Shell,” allow for unauthenticated remote code execution (RCE), providing a direct path for hackers to take control of web servers without needing login credentials.
Federal civilian agencies have been ordered to remediate the vulnerabilities by October 29, 2026. The urgency follows reports that both CISA and independent researchers have confirmed successful RCE in the wild.
Technical Mechanics of PHP2Shell
The PHP2Shell chain consists of two distinct vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which carry a CVSS severity score of 9.2. These bugs affect how PHP handles memory and internal states during abnormal request terminations.
CVE-2026-109618 is a memory corruption flaw that occurs during out-of-memory (OOM) handling. When a PHP process hits a memory limit and attempts to terminate, the error handling routine can be manipulated to corrupt memory. CVE-2026-109619 involves a stale internal request-state vulnerability, where the engine fails to properly clear global states between requests. By chaining these behaviors, attackers can force a server into an unstable state and execute arbitrary commands.
Security researcher Adel Karimi documented successful RCE against honeypot systems on October 24 and October 27, 2026, confirming that the vulnerabilities are no longer theoretical. The risk is particularly high given that PHP powers approximately 70% of all websites globally.
Affected Versions and Remediation
The PHP security team released a series of patches on October 21, 2026, to address the underlying flaws. Administrators are advised to update to the following versions immediately:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
While the official patches cover currently supported branches, for organizations running legacy systems that cannot be immediately upgraded, security experts recommend implementing strict memory limits and monitoring for unusual OOM errors in web server logs as a temporary defensive measure, though these do not replace the necessity of a patch.
The narrow remediation window provided by CISA reflects the high likelihood of automated scanning and exploitation. Because the vulnerabilities allow for unauthenticated access, any publicly reachable server running an unpatched version of PHP is a potential target for ransomware deployment or data exfiltration.
