CISA flags two actively exploited PHP flaws. What the attacker touches next is the harder problem.

Key points

• The US Cybersecurity and Infrastructure Security Agency added two PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on 26 October 2026.
• CVE-2026-109618 is a memory corruption bug; CVE-2026-109619 is a stale internal request-state bug. Both can hand an attacker full control of a web server.
• Federal civilian agencies must patch under Binding Operational Directive 26-04, which also requires them to check whether an attacker got in before the fix landed.
• Attackers are chaining the pair in a technique researchers call PHP2Shell, turning a web flaw into a working command line on the server.
• Threat Vectr's own leak-site tracking shows no ransomware crew has yet claimed a victim tied publicly to these CVEs, though initial-access brokers typically move first.

CISA added two PHP bugs to its Known Exploited Vulnerabilities list on 26 October 2026 and told federal agencies to treat them as urgent. PHP is the programming language running a large share of the public web, from small business sites to login portals.

The two flaws are being chained in attacks researchers call PHP2Shell. A bug in the web software is used to drop a web shell, a small hidden script that lets an attacker type commands on the server as if they were sitting at the keyboard. We first covered these CVEs on 23 October 2026, and our story from 28 October, "PHP2Shell Attackers Got Real Shells on Real Servers. Now the Clock Is Running.", reported a researcher's honeypot catching attackers running actual commands on vulnerable hosts.

What are the two PHP flaws?

One is a memory corruption bug, the other a request-state bug, and both let a remote attacker run their own code on a vulnerable server.

CVE-2026-109618 is the memory corruption issue, where carefully crafted input confuses PHP about what is stored where. CVE-2026-109619 is the stale request-state bug: PHP keeps data from one web request and reuses it in another, which an attacker can abuse to hijack a session or sneak code past checks. CISA hasn't named the groups exploiting them.

Why does CISA care so much about these two?

Because they sit on servers facing the open internet, and exploitation is already happening. Binding Operational Directive 26-04 tells federal civilian agencies to prioritise exactly this profile: public-facing, full takeover, confirmed in-the-wild use.

The directive goes further than a patch-by-date deadline. It requires agencies to look back and ask whether an attacker got in before the patch landed, a step many private organisations still skip. CISA says private organisations should follow the same approach.

Should you worry if you don't run a server?

Most people will never touch a PHP server, but they log into sites built on one. If a service emails you about a security incident or a forced password reset in the coming days, treat it seriously and update the password, particularly anywhere you've reused it.

Here's the part BleepingComputer's PHP2Shell write-up was circling without quite landing on: a CVSS score tells you how loud the front door is, not how much is behind it. Once a web shell lands, what matters is what that server's identity can reach. Database credentials sitting in an environment file. A cloud API key with read access to every customer bucket. The service account an AI agent uses to call internal tools. Patching closes the door the attacker used. Trimming the blast radius, meaning every account and key on that box, decides how bad the next chapter gets. That second job is the one most teams are still behind on.