Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA adds exploited PHP flaws to its KEV catalogue

Part of the CVE-2026-109618 story · since 21 Oct

Developinglatest 1 hour ago44 articles17 outlets
21 Oct · SecurityOnline first24 Oct25 Oct26 OctNowThis article44th of 44
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 06:30 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. Security Affairs. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV. This article, 44th of 44.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog. Both are rated with a CVSS score of 9.2 and affect all PHP versions that handle web requests.

PHP released emergency patches on 21 October 2026 for these vulnerabilities, which reside in the PHP engine itself rather than in individual applications and can be exploited to achieve remote code execution by sending specially crafted HTTP requests without authentication.

Cloudflare researchers observed rapid exploitation attempts after the vulnerabilities became public, reporting tens of thousands of attempts within 45 minutes, hundreds of thousands in two hours, and millions by 22 October. Cyfirma’s threat research linked a North Korea–associated group to a campaign targeting 216 vulnerable PHP hosts, with activity monitored via a private I2P channel.

By 24 October, Cyfirma noted that 216 hosts remained unpatched or only partially mitigated, and that 21 scan nodes were actively used to probe and deploy web-shell tooling and session-poisoning techniques. The operators were observed scanning from 21 compromised machines, with slow, rotating targeting and removal of nodes that exhibited filtering or rate limiting.

CISA has ordered federal agencies to remediate the flaws by 29 October 2026 under the Reducing the Significant Risk of Known Exploited Vulnerabilities directive, with private organisations likewise urged to review the KEV catalog and address applicable issues.

How the story developed

All 44 articles
Developinglatest 1 hour ago44 articles17 outlets

44 articles from 17 outlets since 21 Oct. Still developing; the latest report was 1 hour ago. This was the 44th report, 6 days after the first.

Now21 Oct222324252627First reportSecurityOnline · 21 Oct, 00:58This article44th of 44 · day 6NCSC alert21 Oct, 10:52 · official
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 06:30 UTC. The Hacker News. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. Security Affairs. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV. This article, 44th of 44.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 44 articles as a list
  1. Wed 21 OctDay 017
    1. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm00:58 · SecurityOnline · First report · Known exploited CVE
    2. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts02:31 · Ars Technica · Known exploited CVE
    3. NCSC urges PHP users to patch flaws that could enable server takeover10:52 · NCSC · official · NCSC alert · Known exploited CVE
    Show 14 more from 21 Oct
    1. PHP Prepares Emergency Fixes for Two Critical RCE Flaws06:00 · The Hacker News · Known exploited CVE
    2. Critical PHP2Shell flaws could expose servers to remote code execution07:15 · SecurityWeek · Known exploited CVE
    3. PHP2Shell flaws threaten remote code execution across PHP websites11:00 · Infosecurity · Known exploited CVE
    4. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution11:00 · SOCRadar · Known exploited CVE
    5. Critical PHP Flaws Enable Remote Code Execution Across Web Servers14:06 · Unit 42 · Known exploited CVE
    6. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers15:23 · The Hacker News · Known exploited CVE
    7. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 815:23 · Securelist · Known exploited CVE
    8. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover16:00 · Krebs on Security · Known exploited CVE
    9. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers17:08 · SecurityWeek · Known exploited CVE
    10. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin17:11 · Malwarebytes · Known exploited CVE
    11. Critical PHP flaws enable remote code execution as exploit PoCs emerge17:54 · SANS ISC · Known exploited CVE
    12. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs18:01 · SecurityOnline · Known exploited CVE
    13. Critical PHP Flaws Enable Remote Code Execution Without Login18:01 · Rapid7 · Known exploited CVE
    14. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers19:59 · Dark Reading · Known exploited CVE
  2. Thu 22 OctDay 18
    1. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot09:24 · The Hacker News · Known exploited CVE
    2. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public10:14 · SecurityWeek · Known exploited CVE
    3. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable11:38 · SecurityOnline · Known exploited CVE
    Show 5 more from 22 Oct
    1. Attackers Target Critical PHP Flaws Before Patches Were Released12:52 · SecurityWeek · Known exploited CVE
    2. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting13:29 · SecurityOnline · Known exploited CVE
    3. Gcore Offers Free Web Protection to Governments After PHP Attacks15:23 · SecurityOnline · Known exploited CVE
    4. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed16:01 · Security Affairs · Known exploited CVE
    5. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable16:01 · SOCRadar · Known exploited CVE
  3. Fri 23 OctDay 27
    1. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches00:23 · Darktrace · Known exploited CVE
    2. Okta fixes critical Access Gateway flaws enabling remote code execution04:30 · SecurityOnline · Known exploited CVE
    3. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet08:36 · The Hacker News · Known exploited CVE
    Show 4 more from 23 Oct
    1. PHP Warns of Unpatched RCE Risk in Rare Session Configurations12:00 · The Hacker News · Known exploited CVE
    2. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days12:35 · Security Affairs · Known exploited CVE
    3. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In13:13 · SecurityWeek · Known exploited CVE
    4. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It20:59 · Dark Reading · Known exploited CVE

  4. Quiet for 2 days

    Sun 25 OctDay 41
    1. PHP2Shell attackers target a European government entity19:00 · The Hacker News · Known exploited CVE
  5. Mon 26 OctDay 58
    1. PHP2Shell flaws put products running PHP at risk of remote code execution01:30 · SecurityOnline · Known exploited CVE
    2. Weekly report flags PHP and FortiSIEM flaws under attack03:20 · SecurityOnline · Known exploited CVE
    3. PHP warns of rare RCE flaw and advises disabling upload progress10:01 · Infosecurity · Known exploited CVE
    Show 5 more from 26 Oct
    1. Cyfirma links PHP flaw scans to a North Korean campaign11:30 · Security Affairs · Known exploited CVE
    2. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers14:00 · SecurityWeek · Known exploited CVE
    3. Industrial Vendors Assess Products Affected by PHP2Shell Flaws15:31 · SecurityWeek · Known exploited CVE
    4. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
    5. CISA adds actively exploited PHP flaw enabling remote code execution to KEV23:30 · CISA · official · Known exploited CVE
  6. Tue 27 OctDay 63
    1. CISA adds PHP2Shell flaws to KEV after confirmed attacks04:30 · SecurityOnline · Known exploited CVE
    2. CISA Confirms Exploitation of Two PHP2Shell RCE Flaws06:30 · The Hacker News · Known exploited CVE
    3. CISA adds exploited PHP flaws to its KEV catalogue11:55 · Security Affairs · Known exploited CVE · This article, 44th of 44

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in