CISA confirms PHP2Shell vulnerabilities now exploited in attacks

Attackers are actively exploiting two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unprivileged remote code execution on unpatched systems, prompting CISA to add them to its Known Exploited Vulnerabilities Catalog. Exploitation was detected by honeypots before many organizations had an opportunity to patch, highlighting the dangerously narrow window between public disclosure and weaponization. This incident underscores that unpatched internet-facing services remain one of the most reliable attack vectors, and that organizations without rapid, prioritized patching processes are disproportionately exposed. Federal agencies now face a hard patching deadline, but private sector organizations with no equivalent mandate are equally at risk if they lack mature vulnerability management programs.