CISA Confirms Active Exploitation of PHP2Shell RCE Flaws (CVE‑2026‑109618)
What It Is — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws carry a CVSS 9.2 score and allow unauthenticated remote code execution (RCE) on any PHP deployment that includes the vulnerable component. The primary CVE, CVE‑2026‑109618, is an out‑of‑memory condition that attackers can trigger to execute arbitrary commands. The vulnerabilities were patched upstream, but active exploitation is already observed in the wild.
Affected Products — All PHP environments that ship the PHP2Shell module (commonly used in web‑hosting stacks and custom PHP applications).
Why It Matters for Trust & Control Assurance — Unpatched RCE bugs directly violate the control objective of vulnerability and patch management, a single control that maps to many frameworks (e.g., NIST CSF Identify‑ID.BE‑5).
Recommended Actions —
- Verify that every PHP runtime in your inventory is running the latest patched version that removes PHP2Shell.
- Deploy an automated vulnerability‑scanning tool that continuously checks for the CVE‑2026‑109618 fingerprint and captures remediation evidence.
- Update your change‑management and incident‑response playbooks to include rapid containment steps for unauthenticated RCE events.
Source: The Hacker News