CISA confirms PHP2Shell exploitation and gives federal agencies until Oct. 29 to patch

A week after PHP shipped emergency fixes for two critical flaws, the U.S. government has stopped treating exploitation as a possibility. The Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619, the pair known as PHP2Shell, to its Known Exploited Vulnerabilities catalog on Monday, October 26. Federal civilian agencies now have until Thursday, October 29, to fix them.

The three-day window is the shortest CISA uses. Binding Operational Directive 26-04, issued earlier this year, reserves it for the highest-risk vulnerabilities on publicly exposed systems. Federal News Network reported that CISA officials would prefer agencies move faster than that where they can. The agency said these kinds of vulnerabilities are a frequent attack vector for malicious cyber actors, and while the directive binds only federal civilian agencies, it encouraged every organization to adopt risk-based vulnerability management.

A week earlier CISA had warned about the flaws but said it had not yet seen a successful attack in the wild, as MarketScale reported when the patches landed. Listing in the catalog means the agency has now verified active exploitation, not just scanning or proof-of-concept code. CISA has not said who is behind the attacks, which organizations were hit, or how many production systems were compromised.

What the researchers saw

The clearest public evidence comes from honeypots. Adel Karimi, who leads detection and response at Perplexity, recorded 35 successful shell executions across three honeypots on October 24, according to The Register. The systems ran PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion plus an information leak to reach remote code execution, matching CVE-2026-109618. Afterward the attackers tried to reach outside servers with PHP, curl and wget, but no further malware was successfully downloaded. Karimi cautioned that his honeypots used a single-worker configuration that favored the exploit, so the result may not carry over to production servers.

The volume of attempts is large. Delft University's Threat Intelligence Lab tracked more than 50,000 exploitation requests from over 600 IP addresses in 70 countries, and 171 of those addresses went past probing to send exploit code or malware droppers. Amazon's threat intelligence team saw attempts as early as October 17, four days before the public patches. BleepingComputer reported that Cloudflare, Amazon, Hadrian, watchTowr, Previdian and Patchstack all detected attempts before disclosure and tagged every one as unsuccessful.

Not every early claim held up. Sophos revised its initial assessment after concluding the activity it saw was scanning and failed attempts, and Palo Alto Networks withdrew a claim that linked the flaws to an intrusion at a European government agency.

The patch and the gaps around it

Both bugs are rated 9.2 and allow unauthenticated code execution on a vulnerable PHP server. The fixed releases, out since October 21, are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Systems on older, unsupported branches need an upgrade or a vendor fix, and CISA's guidance is to take anything that cannot be secured offline until it can be. BleepingComputer, citing W3Techs, put PHP behind roughly 70% of websites, and cited VirusTotal estimates of more than 5.1 million PHP hosts exposed online, about 3.8 million of them with at least one open port.

There is also a third problem with no patch. On Friday the PHP security team shared mitigation for CVE-2026-115560, a separate remote code execution flaw it said is exploitable only on systems with an unusual combination of configuration and application code.

The bugs were not new. The PHP Foundation said it identified the first signs of the problem in 2024, and TechCrunch reported that the project left them unpatched at the time because it believed there was no practical way to exploit them. That changed earlier this year, when researchers found a working path with help from an AI model. TechCrunch, citing Reuters, noted the foundation has a single full-time staff member, a reminder that the software behind most of the web is maintained on thin resources.

Three days is tight for most agencies

Hemant Baidwan, chief information security officer at Knox and formerly CISO at the Department of Homeland Security, told Federal News Network the deadline is an aggressive timeline, especially where PHP sits inside applications, containers, appliances or third-party products that scanners may not see. He said teams should hunt for signs of exploitation and check whether systems were compromised before the patch went on, then keep looking for persistence afterward.

Ramy Rahman of ArmorCode said agencies can hit the date, but the hard part is the mix of PHP versions and dependencies they run, many of them old and unsupported. Matt Hull of NCC Group called the flaws about as serious as vulnerabilities get and warned that patching does not guarantee safety if an attacker already planted a backdoor. The window for response, he said, has shrunk from weeks to days or hours.

The flood behind the headline

PHP2Shell is the most visible case of a broader shift. The New York Times reported this week that technology companies are being overwhelmed by bugs surfaced by AI tools. Microsoft has published 1,461 patches this month, compared with 1,247 for all of 2025, according to the Times account summarized by PYMNTS. OpenAI began using its models to hunt for flaws in open-source software in May, and researchers inside and outside the company have since found more than 1,300. Google said it used AI in June to find and fix 1,072 bugs in Chrome.

Fouad Matin, who heads cyber preparedness and safety operations at OpenAI, told the Times that AI opens a Pandora's box of vulnerabilities and that the goal is to scan and patch as much of the world's software as possible. On the receiving end, Node.js maintainer Matteo Collina, chief technology officer at Platformatic, said the project confirmed and fixed a record 50 vulnerabilities this year, called the current wave the first trickle, and expects it to get 10 times worse. He has been working seven days a week and runs AI agents overnight to keep up.

For anyone running PHP, the practical reading is simple. Exploitation is confirmed, attempts number in the tens of thousands, the fix has been available for a week, and the people who find these bugs are now using the same tools that make them easier to exploit. The Register's closing advice was that anyone still waiting for more proof before patching may be waiting a little too long.