CISA Warns of Actively Exploited PHP2Shell Flaws
CISA adds two critical PHP2Shell vulnerabilities to its KEV catalog due to active exploitation. These flaws allow unauthenticated remote code execution, posing severe risks to web applications.
TL;DR
- CISA confirms active exploitation of two high-severity PHP2Shell flaws.
- Both vulnerabilities enable unauthenticated remote code execution.
- Organizations are urged to patch immediately to avoid compromise.
- The flaws are now listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected systems remain at risk of full takeover by malicious actors.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that threat actors are actively exploiting two critical vulnerabilities in PHP2Shell. These flaws, which enable unauthenticated remote code execution, have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, signaling a high risk to organizations using affected systems.
With a CVSS score of 9.2, both CVE-2026-109618 and its counterpart represent serious security gaps that attackers can leverage without needing authentication. Organizations running vulnerable versions of PHP2Shell should prioritize patching to defend against potential system compromise.
Vulnerability Details
- CVE-2026-109618 is an out-of-memory condition leading to remote code execution.
- Both vulnerabilities carry a CVSS score of 9.2, indicating critical severity.
- No authentication is required for exploitation, increasing the risk significantly.
- Successful exploitation allows full control over affected servers.
- These issues affect specific deployments of the PHP2Shell web application.
Impact and Recommendations
- CISA has added these flaws to its KEV list, urging federal agencies to remediate within set deadlines.
- Private sector organizations are also strongly advised to apply patches immediately.
- Attackers could use these flaws to deploy malware, steal data, or gain persistent access.
- Organizations should audit their environments for exposure to PHP2Shell applications.
- Implementing network segmentation and monitoring can help detect abuse attempts.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.