Skip to content
Hacker Posts

CISA adds both PHP2Shell RCE flaws to KEV, 72-hour deadline

CISA put CVE-2026-109618 and CVE-2026-109619 on the KEV catalog on Oct 26 with a Oct 29 federal deadline. Censys counts 32.5M PHP services still unpatched.

Published 3 min read
cvephpadvisoryrceexploited-in-the-wild

CISA added both PHP2Shell remote code execution flaws to its Known Exploited Vulnerabilities catalog on 26 October 2026 and set a federal remediation deadline of 29 October — three days, not the usual three weeks. If you run internet-facing PHP and haven't moved off the vulnerable builds, you are now inside the window where the government's own fix-it clock has nearly run out.

The two bugs are CVE-2026-109618 (unauthenticated RCE via out-of-memory corruption) and CVE-2026-109619 (unauthenticated RCE via a stale internal request-state), both rated CVSS 9.2. We covered the in-the-wild exploitation when Amazon's MadPot honeypot logged an attempt four days before the 21 October patch; CISA's listing now makes the response mandatory for federal agencies and a strong signal for everyone else.

What CISA's listing says

Both entries went live in the KEV catalog on 26 October under vendor "PHP Group":

  • CVE-2026-109619 — "PHP Stale Internal Request-State Vulnerability ... allows for unauthenticated remote code execution."
  • CVE-2026-109618 — "PHP Memory Corruption Vulnerability ... out-of-memory corruption ... allows for unauthenticated remote code execution."

The required action for both: apply vendor mitigations, follow CISA's BOD 26-04 guidance, and complete forensic triage. Where mitigations aren't available, CISA tells agencies to discontinue use of the product. Ransomware association is listed as "Unknown" for both.

Exploitation status

Confirmed. Beyond Amazon's pre-patch honeypot hit, Adel Karimi, detection and response lead at Perplexity, reported successful RCE against honeypot systems on 24 October — "This is now confirmed RCE with usable memory disclosure." No group has claimed responsibility, and no public attribution ties the activity to a named actor. Censys estimates more than 32.51 million PHP services still run an affected version.

Fixed versions

PHP shipped the fixes on 21 October, per the php.net release archive:

8.5.12   8.4.27   8.3.36   8.2.35

Separately, on 26 October the PHP Foundation pushed Windows builds 8.5.12-1 / 8.4.27-1 / 8.3.36-1 / 8.2.35-1 to fix a different bug — the Brotli decoder out-of-bounds write (CVE-2026-111497, "Broccoli2Shell"). Don't conflate the two: the KEV deadline is for the 109618/109619 pair.

Action checklist

  1. Patch internet-facing PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 on the matching branch today — the federal due date is 29 October.
  2. Windows hosts: take the -1 rebuilds, which also carry the Brotli fix.
  3. Treat any host exposed and unpatched since 17 October as potentially compromised. Follow CISA's instruction to run forensic triage, not just patch-and-move-on.
  4. If you can't patch an exposed host before the deadline, pull it from the internet.
  5. Rotate credentials and secrets reachable from any host you suspect was hit.

Context

A three-day KEV deadline is rare; CISA reserves the expedited timeline for flaws under active, low-skill exploitation against a broad install base. The last time a PHP flaw drew this kind of surface-area panic, the fix still left millions of hosts exposed weeks later. The 32.5M figure says the same story is playing out again — the patch exists, the exploitation is confirmed, and the only variable left is how fast operators move.

Related stories