CISA Lists Actively Exploited PHP2Shell RCE Vulnerabilities in KEV
The U.S. Cybersecurity and Infrastructure Security Agency has added two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Both flaws carry a CVSS score of 9.2 and can enable unauthenticated remote code execution on affected PHP deployments.
The additions follow observations reported on October 24 by Adel Karimi, detection and response lead at Perplexity, who confirmed successful remote code execution against honeypot systems. The PHP Project had released fixes on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Two critical paths to remote execution
CVE-2026-109618 is an out-of-memory corruption vulnerability. CVE-2026-109619 stems from stale internal request state. Each issue can be exploited without authentication to execute code remotely on vulnerable PHP installations.
Karimi said the observed chain produced an 800 KiB decoded cookie dump and that a function address derived from that dump, using offsets from the public exploit, appeared in a subsequent execution payload. He cautioned that the evidence applied to an intentionally favourable single-worker mod_php profile and did not measure reliability across other worker counts, PHP builds or applications.
The KEV listing makes the remediation timetable especially significant for U.S. federal civilian agencies, which have until October 29, 2026, to apply the fixes. The development also follows the pattern in which CISA KEV listing for active Drupal SQL injection demonstrates why CISA’s KEV additions demand rapid prioritisation when active exploitation is established.
Exposure extends across the PHP ecosystem
PHP is a server-side scripting language used in roughly 70% of websites, and Censys estimates that more than 32.51 million PHP services remain on affected versions. Vendors and public bodies including ABB, Arista Networks, Broadcom, Citrix, Dell, F5, IBM, Ivanti, Okta, Siemens, Splunk, Synology, Veeam and WordPress have issued advisories or guidance related to the flaws.
The PHP Foundation also issued Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on October 26 to address CVE-2026-111497. That separate out-of-bounds write in the Brotli decoder library, also called Broccoli2Shell, HTTP2Shell and Node2Shell, may result in privilege escalation and unauthenticated remote code execution.
The Brotli issue affects versions 1.0.3 through 1.0.9, 1.1.0 and 1.2.0; fixes are available in 1.0.10, 1.1.1 and 1.2.1. Projects incorporating the library include Node.js, Bun, Envoy Proxy, Istio, .NET and Python. In PHP Windows builds, the vulnerable decoder is reachable through the cURL extension if automatic HTTP response decompression is enabled, although cURL disables that setting by default.
Practical response for operators
Businesses should identify internet-facing PHP services, confirm their precise runtime versions and move affected systems to the released fixed builds. They should also review exposure from PHP Windows applications that enable automatic HTTP response decompression and examine systems for signs of unauthenticated exploitation. Given the confirmed activity and KEV status, patch validation should be treated as an immediate operational task rather than a routine maintenance cycle.