Skip to content
OriginalSign in

SecurityOnlineDo Son

CISA adds PHP2Shell flaws to KEV after confirmed attacks

Part of the CVE-2026-109618 story · since 21 Oct

Developinglatest 51 minutes ago42 articles17 outlets
21 Oct · SecurityOnline first24 Oct25 Oct26 OctNowThis article42nd of 42
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. This article, 42nd of 42.

CISA has added two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog, with a patch deadline for federal agencies set at 29 October 2026. The disclosure follows a report from Adel Karimi of Perplexity that a working PHP2Shell remote code execution (RCE) exploit was observed in the wild, on Apache mod_php running PHP 8.4.26.

Marcus Hutchins of Expel backed the finding, calling it a high-quality in-the-wild confirmation, while prior observations from Dataminr’s TRACE had suggested only scanning and non-working exploits. CISA notes these CVEs are being actively exploited and that the KEV update applies to PHP installations broadly, including related components such as Brotli.

CYFIRMA separately reports a DPRK‑linked campaign probing PHP servers from 216 compromised nodes, targeting systems in the United States, Japan, South Korea, Australia, the EU and other regions, including government, banks, airports and online payment platforms. The firm reasonably links the activity to Lazarus Group‑affiliated operators, warning that exploitation may follow reconnaissance.

The vulnerabilities affect PHP 8.2 prior to 8.2.35, 8.3 prior to 8.3.36, 8.4 prior to 8.4.27 and 8.5 prior to 8.5.12, with patches available to mitigate the risk. PHP 8.1 and older receive no official fixes. Patching guidance includes upgrading to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restarting workers; Windows builds include Brotli fixes via -1 builds. Evidence of exploitation includes PoCs and in-wild reports, with CISA’s SIGMA rule recommended for hunting attempts.

How the story developed

All 42 articles
Developinglatest 51 minutes ago42 articles17 outlets

42 articles from 17 outlets since 21 Oct. Still developing; the latest report was 51 minutes ago. This was the 42nd report, 6 days after the first.

Now21 Oct2223242526First reportSecurityOnline · 21 Oct, 00:58This article42nd of 42 · day 6NCSC alert21 Oct, 10:52 · official
  • Wed 21 Oct, 00:58 UTC. SecurityOnline, first report. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm.
  • Wed 21 Oct, 02:31 UTC. Ars Technica, its first report on the story. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts.
  • Wed 21 Oct, 06:00 UTC. The Hacker News, its first report on the story. PHP Prepares Emergency Fixes for Two Critical RCE Flaws.
  • Wed 21 Oct, 07:15 UTC. SecurityWeek, its first report on the story. Critical PHP2Shell flaws could expose servers to remote code execution.
  • Wed 21 Oct, 10:52 UTC. NCSC, its first report on the story. NCSC urges PHP users to patch flaws that could enable server takeover.
  • Wed 21 Oct, 11:00 UTC. Infosecurity, its first report on the story. PHP2Shell flaws threaten remote code execution across PHP websites.
  • Wed 21 Oct, 11:00 UTC. SOCRadar, its first report on the story. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution.
  • Wed 21 Oct, 14:06 UTC. Unit 42, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Across Web Servers.
  • Wed 21 Oct, 15:23 UTC. The Hacker News. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers.
  • Wed 21 Oct, 15:23 UTC. Securelist, its first report on the story. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 8.
  • Wed 21 Oct, 16:00 UTC. Krebs on Security, its first report on the story. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover.
  • Wed 21 Oct, 17:08 UTC. SecurityWeek. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers.
  • Wed 21 Oct, 17:11 UTC. Malwarebytes, its first report on the story. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin.
  • Wed 21 Oct, 17:54 UTC. SANS ISC, its first report on the story. Critical PHP flaws enable remote code execution as exploit PoCs emerge.
  • Wed 21 Oct, 18:01 UTC. SecurityOnline. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs.
  • Wed 21 Oct, 18:01 UTC. Rapid7, its first report on the story. Critical PHP Flaws Enable Remote Code Execution Without Login.
  • Wed 21 Oct, 19:59 UTC. Dark Reading, its first report on the story. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers.
  • Thu 22 Oct, 09:24 UTC. The Hacker News. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot.
  • Thu 22 Oct, 10:14 UTC. SecurityWeek. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public.
  • Thu 22 Oct, 11:38 UTC. SecurityOnline. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable.
  • Thu 22 Oct, 12:52 UTC. SecurityWeek. Attackers Target Critical PHP Flaws Before Patches Were Released.
  • Thu 22 Oct, 13:29 UTC. SecurityOnline. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting.
  • Thu 22 Oct, 15:23 UTC. SecurityOnline. Gcore Offers Free Web Protection to Governments After PHP Attacks.
  • Thu 22 Oct, 16:01 UTC. Security Affairs, its first report on the story. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed.
  • Thu 22 Oct, 16:01 UTC. SOCRadar. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable.
  • Fri 23 Oct, 00:23 UTC. Darktrace, its first report on the story. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Okta fixes critical Access Gateway flaws enabling remote code execution.
  • Fri 23 Oct, 08:36 UTC. The Hacker News. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. PHP Warns of Unpatched RCE Risk in Rare Session Configurations.
  • Fri 23 Oct, 12:35 UTC. Security Affairs. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days.
  • Fri 23 Oct, 13:13 UTC. SecurityWeek. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In.
  • Fri 23 Oct, 20:59 UTC. Dark Reading. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It.
  • Sun 25 Oct, 19:00 UTC. The Hacker News. PHP2Shell attackers target a European government entity.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. PHP2Shell flaws put products running PHP at risk of remote code execution.
  • Mon 26 Oct, 03:20 UTC. SecurityOnline. Weekly report flags PHP and FortiSIEM flaws under attack.
  • Mon 26 Oct, 10:01 UTC. Infosecurity. PHP warns of rare RCE flaw and advises disabling upload progress.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign.
  • Mon 26 Oct, 14:00 UTC. SecurityWeek. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers.
  • Mon 26 Oct, 15:31 UTC. SecurityWeek. Industrial Vendors Assess Products Affected by PHP2Shell Flaws.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
  • Mon 26 Oct, 23:30 UTC. CISA, its first report on the story. CISA adds actively exploited PHP flaw enabling remote code execution to KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. This article, 42nd of 42.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 42 articles as a list
  1. Wed 21 OctDay 017
    1. PHP Prepares Critical RCE Fixes as Leaked Flaws Raise Alarm00:58 · SecurityOnline · First report
    2. PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts02:31 · Ars Technica
    3. NCSC urges PHP users to patch flaws that could enable server takeover10:52 · NCSC · official · NCSC alert
    Show 14 more from 21 Oct
    1. PHP Prepares Emergency Fixes for Two Critical RCE Flaws06:00 · The Hacker News
    2. Critical PHP2Shell flaws could expose servers to remote code execution07:15 · SecurityWeek
    3. PHP2Shell flaws threaten remote code execution across PHP websites11:00 · Infosecurity
    4. PHP2Shell Flaws Put PHP Servers at Risk of Remote Code Execution11:00 · SOCRadar
    5. Critical PHP Flaws Enable Remote Code Execution Across Web Servers14:06 · Unit 42
    6. PHP Patches Critical Unauthenticated Flaws That Expose Web Servers15:23 · The Hacker News
    7. Critical PHP flaws enable unauthenticated remote code execution across versions 5 to 815:23 · Securelist
    8. PHP Zero Days Put Millions of Websites at Risk of Remote Takeover16:00 · Krebs on Security
    9. PHP Patches PHP2Shell Flaws After Attack Attempts Target Servers17:08 · SecurityWeek
    10. Critical PHP Flaws Trigger Emergency Patches as Attacks Begin17:11 · Malwarebytes
    11. Critical PHP flaws enable remote code execution as exploit PoCs emerge17:54 · SANS ISC
    12. PHP Patches Two Unauthenticated RCE Flaws That Strike Before App Code Runs18:01 · SecurityOnline
    13. Critical PHP Flaws Enable Remote Code Execution Without Login18:01 · Rapid7
    14. Critical PHP Flaws Enable Unauthenticated Code Execution on Servers19:59 · Dark Reading
  2. Thu 22 OctDay 18
    1. Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot09:24 · The Hacker News
    2. Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public10:14 · SecurityWeek
    3. QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable11:38 · SecurityOnline
    Show 5 more from 22 Oct
    1. Attackers Target Critical PHP Flaws Before Patches Were Released12:52 · SecurityWeek
    2. cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting13:29 · SecurityOnline
    3. Gcore Offers Free Web Protection to Governments After PHP Attacks15:23 · SecurityOnline
    4. AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed16:01 · Security Affairs
    5. Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable16:01 · SOCRadar
  3. Fri 23 OctDay 27
    1. PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches00:23 · Darktrace
    2. Okta fixes critical Access Gateway flaws enabling remote code execution04:30 · SecurityOnline
    3. Attackers exploit PHP2Shell flaws to build a Mirai derived botnet08:36 · The Hacker News
    Show 4 more from 23 Oct
    1. PHP Warns of Unpatched RCE Risk in Rare Session Configurations12:00 · The Hacker News
    2. Critical PHP Flaws Trigger Millions of Exploit Attempts in Days12:35 · Security Affairs
    3. Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In13:13 · SecurityWeek
    4. Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It20:59 · Dark Reading

  4. Quiet for 2 days

    Sun 25 OctDay 41
    1. PHP2Shell attackers target a European government entity19:00 · The Hacker News
  5. Mon 26 OctDay 58
    1. PHP2Shell flaws put products running PHP at risk of remote code execution01:30 · SecurityOnline
    2. Weekly report flags PHP and FortiSIEM flaws under attack03:20 · SecurityOnline
    3. PHP warns of rare RCE flaw and advises disabling upload progress10:01 · Infosecurity
    Show 5 more from 26 Oct
    1. Cyfirma links PHP flaw scans to a North Korean campaign11:30 · Security Affairs
    2. PHP2Shell Flaws Used to Gain Shells on Honeypot Servers14:00 · SecurityWeek
    3. Industrial Vendors Assess Products Affected by PHP2Shell Flaws15:31 · SecurityWeek
    4. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News
    5. CISA adds actively exploited PHP flaw enabling remote code execution to KEV23:30 · CISA · official
  6. Tue 27 OctDay 61
    1. CISA adds PHP2Shell flaws to KEV after confirmed attacks04:30 · SecurityOnline · This article, 42nd of 42

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in