CISA Adds Two PHP2Shell RCE Flaws to KEV Catalog

CISA confirmed active exploitation of two PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities catalog. The flaws, both rated 9.2 on the CVSS scale, allow unauthenticated remote code execution on affected PHP deployments. Adel Karimi of Perplexity confirmed successful remote code execution against honeypot systems on October 24, 2026.

What CISA Confirmed

The two vulnerabilities are CVE-2026-109618, an out-of-memory corruption flaw, and CVE-2026-109619, a stale internal request-state flaw. CISA added both to the KEV catalog after Karimi reported confirmed remote code execution with usable memory disclosure. Karimi said the response delivered an 800 KiB decoded cookie dump and that a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload. He also said the evidence demonstrates the chain on the intentionally favorable single-worker mod_php profile and is not a measurement of exploit reliability on other worker counts, PHP builds, or applications.

Patches and Deadlines

The issues were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026. Federal agencies have until October 29, 2026, to apply the necessary fixes. According to estimates shared by Censys, more than 32.51 million PHP services are still running an affected version. PHP is used in roughly 70% of all websites on the internet. The severity of the vulnerabilities prompted advisories from numerous software, security and government organizations, including ABB, Arista Networks, Belden, Broadcom, Canon, Citrix, Dell, Dormakaba, F5, Hikvision, HP, HPE, Hitachi Energy, HMS Networks, Huawei, IBM, Ivanti, Johnson Controls, Mitel, Moxa, NETGEAR, Okta, QNAP, Rockwell Automation, Ruckus Wireless, Salesforce, Schneider Electric, Siemens, SonicWall, Splunk, Synology, Veeam, Wibu-Systems and WordPress.

Related Windows Build Issue

As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497. That flaw is an out-of-bounds write vulnerability in the Brotli decoder library that could also result in privilege escalation and unauthenticated remote code execution. The vulnerability, also known as Broccoli2Shell, HTTP2Shell, and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with other projects that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python. "In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled," the PHP Foundation said. "This is disabled by default in cURL, but applications and HTTP client libraries can enable it."

Earlier coverage: VulnCheck Develops PHP2Shell Exploit That Bypasses ASLR on Production Systems · PHP flags unpatched RCE risk in narrow setup after PHP2Shell emergency patches

Sources: The Hacker News