Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV

Part of the CVE-2026-109619 story · since 21 Oct

Developinglatest 1 hour ago40 articles17 outlets
21 Oct · SecurityOnline first24 Oct25 Oct26 OctNowThis article40th of 40
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
  • Mon 26 Oct, 23:31 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV. This article, 40th of 40.

CISA added CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October 2026. The flaw affects PHP, maintained by the PHP Group, and is known as the PHP Stale Internal Request-State Vulnerability. It allows unauthenticated remote code execution.

The vulnerability is a stale internal request-state flaw. Available data describes its impact as remote code execution without authentication but does not provide further details about the underlying mechanism or attack vector. It has a CVSS score of 9.2, rated Critical. A patch is available through the PHP project’s security advisory.

KEV inclusion indicates confirmed active exploitation. Use in ransomware campaigns is unknown. CISA set 29 October 2026 as the remediation deadline for affected federal agencies.

CISA requires organisations to apply mitigations in accordance with vendor instructions and comply with BOD 26-04 guidance on prioritising security updates based on risk and CISA’s Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly affected by the requirement.

All organisations should review their PHP deployments, assess each asset’s internet exposure and apply the available patch in line with relevant guidance.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-109619) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.

How the story developed

All 40 articles
Developinglatest 1 hour ago40 articles17 outlets

40 articles from 17 outlets since 21 Oct. Still developing; the latest report was 1 hour ago. This was the 40th report, 6 days after the first.

Now21 Oct2223242526First reportSecurityOnline · 21 Oct, 00:58This article40th of 40 · day 5NCSC alert21 Oct, 10:52 · official
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
  • Mon 26 Oct, 23:31 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV. This article, 40th of 40.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 40 articles as a list
  1. Wed 21 OctDay 017
    1. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm00:58 · SecurityOnline · First report
    2. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts02:31 · Ars Technica
    3. NCSC urges PHP users to patch flaws that could enable server takeover10:52 · NCSC · official · NCSC alert
    Show 14 more from 21 Oct
    1. PHP Prepares Emergency Fixes for Two Critical RCE Flaws06:00 · The Hacker News
    2. Critical PHP2Shell flaws could expose servers to remote code execution07:15 · SecurityWeek
    3. PHP2Shell flaws threaten remote code execution across PHP websites11:00 · Infosecurity
    4. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution11:00 · SOCRadar
    5. Critical PHP Flaws Enable Remote Code Execution Across Web Servers14:06 · Unit 42
    6. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers15:23 · The Hacker News
    7. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 815:23 · Securelist
    8. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover16:00 · Krebs on Security
    9. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers17:08 · SecurityWeek
    10. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin17:11 · Malwarebytes
    11. Critical PHP flaws enable remote code execution as exploit PoCs emerge17:54 · SANS ISC
    12. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs18:01 · SecurityOnline
    13. Critical PHP Flaws Enable Remote Code Execution Without Login18:01 · Rapid7
    14. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers19:59 · Dark Reading
  2. Thu 22 OctDay 17
    1. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot09:24 · The Hacker News
    2. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public10:14 · SecurityWeek
    3. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable11:38 · SecurityOnline
    Show 4 more from 22 Oct
    1. Attackers Target Critical PHP Flaws Before Patches Were Released12:52 · SecurityWeek
    2. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting13:29 · SecurityOnline
    3. Gcore Offers Free Web Protection to Governments After PHP Attacks15:23 · SecurityOnline
    4. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed16:01 · Security Affairs
  3. Fri 23 OctDay 27
    1. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches00:23 · Darktrace
    2. Okta fixes critical Access Gateway flaws enabling remote code execution04:30 · SecurityOnline
    3. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet08:36 · The Hacker News
    Show 4 more from 23 Oct
    1. PHP Warns of Unpatched RCE Risk in Rare Session Configurations12:00 · The Hacker News
    2. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days12:35 · Security Affairs
    3. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In13:13 · SecurityWeek
    4. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It20:59 · Dark Reading

  4. Quiet for 2 days

    Sun 25 OctDay 41
    1. PHP2Shell attackers target a European government entity19:00 · The Hacker News
  5. Mon 26 OctDay 58
    1. PHP2Shell flaws put products running PHP at risk of remote code execution01:30 · SecurityOnline
    2. Weekly report flags PHP and FortiSIEM flaws under attack03:20 · SecurityOnline
    3. CISA adds actively exploited PHP flaw allowing unauthenticated code execution to KEV23:31 · CISA · official · This article, 40th of 40
    Show 5 more from 26 Oct
    1. PHP warns of rare RCE flaw and advises disabling upload progress10:01 · Infosecurity
    2. Cyfirma links PHP flaw scans to a North Korean campaign11:30 · Security Affairs
    3. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers14:00 · SecurityWeek
    4. Industrial Vendors Assess Products Affected by PHP2Shell Flaws15:31 · SecurityWeek
    5. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in