The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has verified that two newly patched PHP2Shell vulnerabilities are being exploited in the wild, enabling unauthenticated remote code execution (RCE) in affected PHP deployments. The flaws—tracked as CVE-2026-109618 and CVE-2026-109619—have been formally added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities both carry a 9.2 severity rating under the CVSS system.
What the Flaws Are and How They Were Discovered
CVE-2026-109618 stems from an out-of-memory corruption issue that allows attackers to execute code without authentication. CVE-2026-109619 involves a stale internal request-state that similarly permits unauthorized RCE. Evidence of active exploitation emerged on October 24, 2026, when honeypot systems showed successful RCE attacks. Specifically, one attacker retrieved roughly 800 KiB of decoded cookie data and used it to derive a function address, integrating it into a subsequent payload for code execution. The tests were carried out using a favorable mod_php setup with a single worker. The exploit’s effectiveness under other configurations—different worker counts, PHP builds, or applications—has not yet been broadly assessed.
Patches, Exposure, and Mitigation Race Against Time
The PHP team released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address both vulnerabilities. Federal agencies in the U.S. are required to apply these updates by October 29, 2026. Despite the patches, more than 32.5 million PHP services are estimated to be running versions still vulnerable to attack. This leaves a large risk surface for web servers globally.
The PHP implementation on Windows platforms also faced trouble from a related issue known as Broccoli2Shell (also referred to as HTTP2Shell or Node2Shell)—an out-of-bounds write flaw in the Brotli decoder library that could lead to privilege escalation or RCE. Affected versions include Brotli 1.0.3 through 1.0.9, as well as 1.1.0 and 1.2.0. Fixes arrived with versions 1.0.10, 1.1.1, and 1.2.1. The vulnerability in PHP’s Windows builds is reachable when the cURL extension has automatic HTTP response decompression enabled, which is off by default but can be enabled by applications or HTTP libraries.
The severity of these flaws has prompted alerts and guidance from dozens of technology vendors and government agencies worldwide.
What this means: The PHP2Shell bugs are not just theoretical threats—they’re being leveraged in live attacks, and higher-risk systems, especially those using older PHP versions or default-enabled Brotli decompression on Windows, are vulnerable right now. The window for patching is narrow.
Why it matters: PHP runs on roughly 70% of websites globally, making any widespread vulnerability in the language a major concern for web security. With millions of services still exposed, the potential for damage—from data theft to full server compromise—is large.
What to watch next: Assess your PHP environment immediately. Update to the fixed versions if you haven’t already. Disable Brotli response decompression in cURL on Windows unless it’s strictly necessary. Monitor for evidence of compromise—particularly unusual requests, large cookie payloads, or unexpected process execution. Vendors and governments will likely issue more advisories as more exploit attempts are observed.
