PHP2Shell Critical RCE Flaws (CVE‑2026‑109618 & CVE‑2026‑109619) Actively Exploited
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical PHP vulnerabilities, tracked as PHP2Shell (CVE‑2026‑109618 and CVE‑2026‑109619), to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws allow unauthenticated remote code execution (RCE) on systems running unpatched PHP 8.4.26 with Apache mod_php. Proof‑of‑concept exploits were published before the patches were released, and multiple security firms observed exploitation attempts in the wild, with Perplexity’s honeypots confirming successful RCE. CISA issued Binding Operational Directive 26‑04, ordering all Federal Civilian Executive Branch agencies to apply the patches by Thursday. The agency also urged all organizations to adopt risk‑based vulnerability management and prioritize remediation of KEV items.
Why It Matters for Trust & Control Assurance — The event underscores the need for a disciplined vulnerability‑management program that provides timely, auditable evidence of remediation—a control area that satisfies many frameworks simultaneously.
Who Is Affected — Web‑hosting providers, SaaS platforms, e‑commerce sites, and any organization that runs PHP‑based applications—including federal agencies.
Recommended Actions
- Deploy the PHP 8.4.26 patch that resolves CVE‑2026‑109618 and CVE‑2026‑109619 immediately.
- Verify patch status across all production PHP instances using automated inventory tools.
- Integrate CISA’s KEV catalog into your continuous vulnerability‑scanning pipeline to flag high‑severity flaws early.
- Document remediation steps and retain evidence for audit readiness.
Technical Notes
- Attack vector: Unauthenticated remote code execution via crafted HTTP requests to vulnerable mod_php modules.
- CVEs: CVE‑2026‑109618, CVE‑2026‑109619 (both CVSS 9.8 Critical).
- Exploitation evidence: Honeypot logs from Perplexity and telemetry from Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack.
- Scope: Approximately 5.1 million PHP hosts online; ~3.8 million expose at least one port.