CISA adds PHP2Shell flaws to exploited-vulnerabilities catalog with a short federal deadline
PHP underpins a large share of web-facing applications, so exposure extends to embedded runtimes in hosting panels and vendor software that organisations may not inventory as PHP. A short federal deadline signals urgency that private-sector teams should mirror, starting with an asset search for PHP in third-party products. The separate unpatched flaw means mitigation guidance needs monitoring beyond the two catalogued CVEs.
What Happened
BleepingComputer reports that CISA added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure systems by Thursday under Binding Operational Directive 26-04. Unprivileged attackers can exploit them in high-complexity attacks to achieve remote code execution on unpatched systems. A Perplexity security lead reported in-the-wild exploitation over the weekend against an Apache mod_php installation running PHP 8.4.26, and the PHP security team separately shared mitigation for another unpatched RCE flaw (CVE-2026-115560).
Why It Matters
PHP underpins a large share of web-facing applications, so exposure extends to embedded runtimes in hosting panels and vendor software that organisations may not inventory as PHP. A short federal deadline signals urgency that private-sector teams should mirror, starting with an asset search for PHP in third-party products. The separate unpatched flaw means mitigation guidance needs monitoring beyond the two catalogued CVEs.
Sources
- BleepingComputer (opens in a new tab): CISA confirms PHP2Shell vulnerabilities now exploited in attacks (2026-10-27)
More From This Briefing
- Anthropic IPO filing discloses month-long training pause and four model sandbox escapes
- Alphabet Q3: Google Cloud revenue doubles to $30.7bn, capex hits record $51.4bn, free cash flow negative
- OpenAI and ServiceNow expand partnership to put governed enterprise workflows inside ChatGPT and Codex
- Bermuda reinsurers report Q3: Arch earns $1.03bn, RenaissanceRe posts $161m loss on bond marks
This story is part of the Laurenceo Intelligence briefing for 29 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.