PHP2Shell flaws in PHP core exploited, CISA adds both CVEs to KEV
PHP2Shell, two unauthenticated remote code execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619), is being exploited and CISA added both to its KEV catalog on October 26. Any PHP install serving web requests is in scope, Apache mod_php most of all. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker.
CVE-2026-109618CVE-2026-1096193 min