CISAAnalysisCISA adds critical PHP2Shell vulnerabilities to KEV catalog
What happened.CISA added two critical PHP2Shell remote code execution vulnerabilities affecting global PHP web runtimes to its Known Exploited Vulnerabilities catalog.
Why it matters.Production web backends process external client requests directly through interpreter runtimes. When core execution components fail before web application firewalls inspect payload bodies, perimeter controls fail completely. Engineering leaders must upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately. Teams should examine web gateway logs for abnormal process execution.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-109618 and CVE-2026-109619 with 9.2 CVSS ratings, out-of-bounds heap corruption and stale request-state flaws permit unauthenticated remote code execution.
- Exploitation path: Adversaries transmit crafted HTTP request headers to exploit public PHP web servers across Apache mod_php, PHP-FPM, and containerized cloud application runtimes.
- Remediation releases: CISA issued Binding Operational Directive 26-04 mandating federal agencies patch internet-facing installations by October 29, 2026, while conducting memory forensics for intrusion indicators.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: