Particle.news
Get it on Google Play
Download on the App Store
7 ARTICLES
·
3h ago

CISA Says PHP2Shell Flaws Are Being Actively Exploited

The engine-level bugs let attackers run code on unpatched web servers, prompting a federal emergency remediation order.

Image
Image
A page on the BBC website which is temporarily unavailable. A critical flaw in the programming language PHP was revealed "earlier than it was supposed to have been", which mean hackers started checking websites to see if they could exploit the vulnerability, an expert has said. Some "limited" Government services may temporarily be offline while work is carried out to address potential cybersecurity issues, Downing Street has said. Organisations around the world have been scrambling to fix a critical security flaw in the programming language PHP used by the majority of websites. Picture date: Thursday October 22, 2026. (Photo by Yui Mok/PA Images via Getty Images)
Image

Overview

  • CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to remediate by October 29 to stop active attacks.
  • The two flaws live in the PHP engine and allow unauthenticated remote code execution, with vulnerable code tracing back to PHP 5.4 and affecting common setups such as Apache mod_php, PHP-FPM and php-cgi.
  • PHP emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were published on October 21 to fix the bugs and Windows builds were updated days later to address a related Brotli decoder issue.
  • Security telemetry shows probing began before public disclosure, mass automated scanning spiked after the fixes were posted, and Perplexity’s Adel Karimi confirmed usable remote shells against a mod_php honeypot on October 24.
  • Full remediation requires updated PHP binaries, web worker restarts and vendor backports for embedded or end-of-life builds, and organizations should hunt for signs of prior compromise because many internet-facing PHP instances remain exposed.