The PHP2Shell episode escalated on Monday from critical flaw to confirmed exploited flaw. The Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, on evidence of active exploitation, and set a remediation due date of October 29 for federal civilian executive branch agencies under Binding Operational Directive 26-04, which also requires agencies to check whether exposed systems were already compromised before or while patching.
The two flaws, rated 9.2 under CVSS 4.0 by the PHP Group, allow an unauthenticated attacker to run code on servers using PHP to answer web requests. One is a memory corruption error in out of memory handling that can leave request memory partly initialized; the other leaves internal request state surviving after its memory is freed. Apache with mod_php is rated the highest risk deployment. Fixed versions, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were released on October 21, and branches at 8.1 and earlier get no further project patches.
This site has covered the disclosure argument around these flaws since October 21, including The Register’s warning that the episode is a lesson in disclosure practice. The KEV listing ends the argument about urgency: CISA does not list vulnerabilities on potential, and its updated alert directs organisations that cannot update immediately, or that still run unsupported versions, to take PHP based systems offline until they can be patched.
For technology teams the operational point is the calendar. A three day federal window, ending the same day Amazon and Sandisk report and a day after the Federal Reserve decision, is now the reference deadline for every private operator running the same stack, and Rapid7’s advice is to treat the current difficulty of reliable exploitation as a window to patch rather than a reason to delay.