CISA has confirmed that PHP2Shell vulnerabilities are being actively exploited in the wild.

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that PHP2Shell vulnerabilities are being actively exploited in the wild. - https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation. ⠀ Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests. Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk. ⠀ Both vulnerabilities have a CVSS 4.0 score of 9.2. Fixed versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ⠀ CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29. The PHP team says there are no complete mitigations and that updating is the only safe solution. Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog