Overview
- CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on Monday and ordered federal civilian agencies to remediate by Oct. 29.
- The PHP project released emergency fixes on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to repair two engine flaws that allow unauthenticated remote code execution.
- Cloudflare telemetry showed exploit attempts surged from thousands to millions of requests within hours of disclosure and Perplexity researcher Adel Karimi confirmed usable remote code execution against an Apache mod_php honeypot on Oct. 24.
- Security firm Dream documented attackers chaining PHP2Shell with a Linux kernel local privilege escalation called Fragnesia (CVE-2026-46300) to root 25 servers, including systems in a U.S. government‑affiliated environment, and CISA has added Fragnesia to KEV with an Oct. 31 remediation deadline.
- Remediation is difficult because tens of millions of PHP instances remain on vulnerable builds and many appliances embed PHP in firmware so customers must wait for vendor patches; operators are advised to isolate internet‑exposed management interfaces, apply virtual patching and hunt logs and memory for pre‑patch intrusions.