CISA Confirms Active Exploitation of PHP2Shell Vulnerabilities as Attackers Target Unpatched Web Servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two critical vulnerabilities in PHP, collectively known as PHP2Shell, are being exploited in real-world attacks, escalating concerns over weaknesses affecting one of the most widely deployed server-side programming languages on the internet.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated attackers to achieve remote code execution under certain conditions. Their exploitation could give adversaries the ability to execute commands on vulnerable servers, potentially exposing sensitive information, compromising hosted applications, and establishing a foothold inside enterprise networks.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026, just five days after the PHP development team released security updates addressing the flaws. The agency also directed affected U.S. federal civilian executive branch organizations to complete remediation by October 29, establishing an unusually short deadline in response to the emerging threat.
The warning marks a significant development in the PHP2Shell incident. Earlier reports documented widespread exploitation attempts against internet-facing PHP installations, but multiple security companies initially classified those attempts as unsuccessful. Subsequent evidence collected through security honeypots demonstrated that attackers had achieved actual remote code execution against at least one vulnerable configuration.
The distinction is critical. What began as a race between vulnerability disclosure and opportunistic scanning has developed into a confirmed exploitation threat, increasing the urgency for organizations that have not yet deployed the available patches.
Two Critical Vulnerabilities Threaten PHP Deployments
PHP is a foundational component of modern web infrastructure, powering content management systems, e-commerce applications, enterprise portals, and custom business services.
According to W3Techs, PHP is used by approximately 70% of websites whose server-side programming language can be identified. Its extensive deployment means that vulnerabilities affecting the language runtime can have consequences across numerous applications and hosting environments.
CVE-2026-109618 and CVE-2026-109619 introduce remote code execution risks that can be exploited without prior authentication, although the attacks involve high complexity and depend on the characteristics of the target environment.
This distinction matters because the vulnerabilities should not be interpreted as guaranteeing immediate compromise of every server running an affected PHP version. Successful exploitation depends on technical conditions that may vary between deployments, including server configuration and the way PHP interacts with application code.
Nevertheless, the absence of an authentication requirement makes the vulnerabilities particularly concerning for internet-facing services. Attackers do not necessarily need stolen credentials or an existing user account to begin attempting exploitation.
When a remote code execution vulnerability is successfully triggered, the attacker may gain the ability to execute instructions within the security context of the affected PHP process.
The resulting impact depends on the permissions assigned to that process and the surrounding security controls. A web server running with restricted privileges may limit some attacker capabilities, while an application with access to sensitive files, database credentials, or internal services can create opportunities for further compromise.
In poorly segmented environments, a successful PHP compromise could also become a starting point for lateral movement into other systems.
The two vulnerabilities were addressed by the PHP security team on October 21, following an urgent advisory issued the previous day encouraging administrators to prepare for immediate patch deployment.
Attackers Began Targeting PHP2Shell Before Patches Were Available
One of the most troubling aspects of the PHP2Shell incident is the timing of the initial exploitation attempts.
Amazon Threat Intelligence reported that attackers began probing for the vulnerabilities approximately four days before the official security updates became available. This indicates that malicious actors had obtained enough information to begin testing potential exploitation techniques before administrators could deploy a complete vendor fix.
The early activity followed the exposure of sensitive vulnerability information ahead of the coordinated disclosure.
Details concerning PHP2Shell, including the associated CVE identifiers and mitigation guidance intended for critical infrastructure operators, became publicly accessible before the patches were released. Proof-of-concept exploit code also appeared online during the same period.
The PHP security team subsequently stated that the publicly available proof-of-concept exploits were not functional.
That assessment was consistent with initial observations from several security companies, including Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack, which detected exploitation attempts but did not initially identify successful attacks.
The distinction between attempted and successful exploitation is particularly important in vulnerability reporting. Automated scanning, malformed requests, and unsuccessful exploit payloads can generate substantial malicious traffic without demonstrating that an attacker has obtained code execution.
However, the volume and timing of the activity indicated that attackers were actively experimenting with the vulnerabilities and attempting to develop reliable exploitation techniques.
This pattern is common when details of a serious vulnerability become available before defensive updates are widely deployed. Attackers rapidly test public and privately developed payloads against exposed systems, while defenders must identify affected assets and prepare remediation.
The PHP2Shell incident illustrates how even a relatively short disclosure-to-patch interval can create an opportunity for adversaries when technical information becomes available prematurely.
Honeypot Evidence Confirms Successful Remote Code Execution
The strongest public evidence of successful PHP2Shell exploitation emerged from security monitoring infrastructure operated by Perplexity.
Adel Karimi, the company's detection and response lead, reported that honeypots had recorded successful remote code execution against an Apache web server using the mod_php integration and running PHP 8.4.26.
The observation provided concrete evidence that the vulnerabilities could be exploited in a real deployment configuration rather than merely producing errors or triggering unsuccessful attack attempts.
The affected configuration is significant because mod_php integrates the PHP interpreter directly into the Apache HTTP Server process model. It represents one of several ways PHP applications can be deployed, alongside alternatives such as PHP-FPM and CGI-based execution.
The successful exploitation of an Apache mod_php environment does not establish that every PHP deployment model is equally vulnerable. Different configurations can expose different code paths, and the reliability of an exploit may depend on specific environmental conditions.
Nevertheless, the honeypot findings demonstrated that the risk was no longer theoretical.
CISA's subsequent decision to add both CVE identifiers to its KEV catalog independently confirmed that the agency had sufficient evidence to classify the vulnerabilities as actively exploited.
CISA has not publicly disclosed the identities of the attackers, the number of organizations compromised, or the full range of post-exploitation activities associated with PHP2Shell.
As a result, claims about widespread successful compromise, specific malware families, or attribution to particular threat groups would go beyond the currently available evidence.
The confirmed exploitation is serious enough without assuming that every observed scanning attempt resul