Overview
- The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, signaling observed in‑the‑wild use of the two PHP engine bugs.
- PHP issued emergency fixes on October 21 for supported branches, but researchers reported a working remote code execution against a mod_php honeypot on October 24 and exploit traffic surged after disclosure.
- Security firm reports show attackers have chained PHP2Shell with a Linux kernel privilege escalation to root firewall appliances and drop web shells, with one firm saying 25 servers were rooted during attacks on October 23–25.
- Scanning and telemetry show large scale exposure: Censys and other trackers report tens of millions of internet‑facing PHP services still reporting vulnerable versions, and many devices embed PHP inside firmware so customers must wait for vendor updates.
- Defenders face a tight window to hunt for pre‑patch compromises, apply PHP updates or vendor firmware, and deploy network mitigations while federal agencies work to meet CISA’s remediation directive due October 29.