CISA adds PHP 'php2shell' remote code execution flaws to Known Exploited Vulnerabilities catalog
Unauthenticated remote code execution in a language that underpins a very large share of web applications and content management systems means exposure is broad and the window between disclosure and compromise is short. Inclusion in the catalog signals exploitation in the wild, so patching should be treated as an emergency change rather than a scheduled cycle. Teams should also inventory PHP runtimes embedded in third-party and legacy applications and use the published detection rule to look for prior compromise.
What Happened
CISA urged organisations to immediately patch two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "php2shell", which allow unauthenticated remote code execution. On 26 October 2026 CISA added both to its Known Exploited Vulnerabilities catalog and updated its alert. A 23 October update added a SIGMA detection rule and partner resources.
Why It Matters
Unauthenticated remote code execution in a language that underpins a very large share of web applications and content management systems means exposure is broad and the window between disclosure and compromise is short. Inclusion in the catalog signals exploitation in the wild, so patching should be treated as an emergency change rather than a scheduled cycle. Teams should also inventory PHP runtimes embedded in third-party and legacy applications and use the published detection rule to look for prior compromise.
Sources
- CISA (opens in a new tab): Critical Vulnerabilities in PHP Require Immediate Patching (2026-10-26)
- CISA (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-26)
More From This Briefing
- CISA flags actively exploited critical flaws in Arista VeloCloud Orchestrator and Collabora Online
- Malaysia names SoftBank as investor behind proposed US$50 billion AI and data centre programme
- Zerohash and Majority launch stablecoin remittances to Latin America
This story is part of the Laurenceo Intelligence briefing for 27 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.