On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that the recently patched PHP2Shell vulnerabilities are being actively exploited, adding them to its Known Exploited Vulnerabilities (KEV) catalog.
Both PHP vulnerabilities, which have a CVSS score of 9.2, enable unauthenticated remote code execution on affected systems:
- CVE-2026-109618 – A vulnerability related to out-of-memory corruption that permits unauthenticated remote code execution.
- CVE-2026-109619 – A vulnerability concerning stale internal request-state that allows for unauthenticated remote code execution.
The inclusion of these vulnerabilities in the KEV catalog follows confirmation from Adel Karimi, detection and response lead at Perplexity, regarding successful remote code execution incidents against honeypot systems on October 24, 2026.
Karimi stated, “This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit’s offsets appears in the subsequent execution payload.”
He further noted, “The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications.”
The vulnerabilities have been resolved in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which were released on October 21, 2026. Federal agencies have until October 29, 2026, to implement the necessary updates.
PHP, which stands for PHP: Hypertext Preprocessor, is a server-side scripting language utilized by approximately 70% of all websites globally. Estimates from Censys indicate that over 32.51 million PHP services are still operating on an affected version.
The critical nature of these vulnerabilities has led to multiple advisories from software and security vendors, as well as government agencies worldwide, including:
- ABB
- Arista Networks
- Belden
- Broadcom
- Canon
- Citrix
- Craft CMS
- Dell
- Dormakaba
- Drupal
- ExpressionEngine
- F5
- Hikvision
- HP
- HPE
- Hitachi Energy
- HMS Networks
- Huawei
- IBM
- Ivanti
- Johnson Controls
- Mitel
- Moxa
- NETGEAR
- October CMS
- Okta
- QNAP
- Rockwell Automation
- Ruckus Wireless
- Salesforce
- Schneider Electric
- Siemens (1), (2)
- SonicWall
- Splunk
- Synology
- Veeam
- Wibu-Systems
- WordPress
As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could lead to privilege escalation and unauthenticated remote code execution.
This vulnerability, referred to as Broccoli2Shell, HTTP2Shell, and Node2Shell, impacts Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with other projects that include the C library, such as Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.
The PHP Foundation stated, “In PHP Windows builds, the vulnerable decoder can be accessed through the cURL extension when automatic HTTP response decompression is enabled. This feature is disabled by default in cURL, but applications and HTTP client libraries can enable it.”
Source: Original article
