PHP2Shell added to CISA's Known Exploited Vulnerabilities catalog

PHP2Shell: CVE-2026-109618 and CVE-2026-109619

• What: CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell, are a critical flaw in PHP itself that lets an attacker run code remotely without logging in.
• Exploited: Yes. Added to the CISA Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 29.
• Fixed in: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

What to do

1. Update PHP to the fixed release for your branch.
2. CISA calls for a compromise check on these two CVEs. For any server that ran a vulnerable PHP build while the flaw was public, consider:
   • reviewing web server access logs for unusual requests to PHP endpoints;
   • looking for unknown administrator accounts in applications such as WordPress;
   • searching upload directories (for example wp-content/uploads/) for unexpected .php files.

Also noted

• PHP's other builds released the same day only matter on Windows.