Cyberattacks | Vulnerabilities

CISA Lists PHP2Shell as Exploited After Honeypot Attack Succeeds

A researcher’s honeypot caught attackers running code through PHP’s two critical new flaws, and US agencies now have days to patch.

By Content Team

Oct 27, 2026

ON THIS PAGE

CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Both flaws score 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution. The listing followed successful code execution against honeypots on October 24, reported by Perplexity detection and response lead Adel Karimi.

Karimi noted the chain ran on a deliberately favorable single-worker Apache mod_php setup, so it doesn’t show how reliably the exploit works elsewhere. Censys estimates more than 32.5 million PHP services still run an affected version.

Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, and US federal agencies must apply them by October 29. PHP 8.1 and earlier no longer receive official fixes.

Source: The Hacker News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?