CISA Sets October 29 Deadline for PHP2Shell Flaws

The Cybersecurity and Infrastructure Security Agency has added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered U.S. civilian federal agencies to address them by October 29, 2026. The catalog listing covers CVE-2026-109618 and CVE-2026-109619, flaws in PHP that can allow remote code execution on vulnerable systems. PHP released patches on October 21. CISA’s deadline applies to civilian federal agencies, not all organizations, though the agency has also urged other organizations to prioritize remediation. CISA has not disclosed details about the activity or identified potential victims. Its guidance defines active exploitation to include both attempted and successful attacks, so the catalog entry alone does not establish that attackers successfully compromised systems beyond reported test environments. Adel Karimi, detection and response lead at Perplexity, said honeypots recorded successful remote code execution on October 24 against an Apache mod_php installation running PHP 8.4.26. That report describes activity observed in a honeypot, rather than a confirmed compromise of an identified organization. The reporting does not establish...