Critical PHP2Shell Vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) Enable Remote Code Execution
What It Is — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP flaws, CVE‑2026‑109618 and CVE‑2026‑109619, to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws allow unauthenticated attackers to execute arbitrary commands on vulnerable web servers via specially crafted requests (remote code execution). CISA’s advisory confirms active exploitation in the wild and mandates that all federal agencies patch affected PHP installations within 30 days. The vulnerabilities receive CVSS v3.1 base scores of 9.8 (critical). No official vendor‑issued patches were available at the time of reporting; mitigations include disabling the vulnerable functions or applying temporary work‑arounds.
Affected Products — PHP runtime versions 7.4 through 8.2 that include the vulnerable proc_open and shell_exec handling logic.
Why It Matters for Trust & Control Assurance — Timely remediation of critical flaws is a core control‑objective for vulnerability management; demonstrating patch compliance provides defensible evidence across multiple frameworks (e.g., NIST CSF 2.0).
Recommended Actions
- Inventory every PHP runtime in your environment and identify versions 7.4‑8.2.
- Apply the vendor‑released patches or, if unavailable, implement the recommended mitigations (disable
proc_open/shell_exec, enforce strict input validation). - Verify remediation with authenticated scanning and retain evidence of patch status.
- Update your vulnerability‑management policy to include a 30‑day remediation SLA for KEV‑listed items.
Source: HackRead article