Two critical PHP vulnerabilities that let unauthenticated attackers run arbitrary code on web servers now carry the KEV Catalog's full weight. CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities Catalog on October 26, 2026, after the bugs had already been spotted in active attacks. The flaws go by the name "php2shell" and they affect every PHP installation that serves web requests.
The vulnerabilities sit in PHP itself, not in a third-party framework or plugin. That distinction matters. A bug in a single CMS plugin can be patched by updating one package. A bug in the language runtime hits every stack built on top of it, from WordPress to custom enterprise applications.
The risk is immediate. PHP is often a component of other software, and its prevalence may not be directly observable inside an organization. A server inventory that lists "Apache" and "WordPress" might not mention PHP at all, even though PHP is doing the work underneath.
What php2shell Actually Does
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in PHP. An attacker who reaches a vulnerable endpoint can run commands on the server without logging in. CISA describes the issue as critical and urges organizations to patch immediately.
The affected deployment models cover the full range of PHP serving stacks. Apache with mod_php is flagged by PHP itself as the highest-risk configuration. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are also vulnerable. If your server serves PHP to the web, assume you are in scope until you verify otherwise.
The name "php2shell" hints at the end state. Remote code execution in a web runtime usually ends with a shell. From there an attacker can pivot laterally, pull down additional tooling, or establish persistence. CISA's detection guidance tells defenders to watch for PHP worker processes launching shells or downloading tools.
The Patch and Where to Get It
PHP shipped fixed versions that close both CVEs. Organizations should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The version you choose depends on which branch your applications support, but the key point is that all four branches have a patched release.
Systems running PHP 8.1 or earlier are in a worse position. Those branches are unsupported, which means no official patch exists for them. CISA's guidance for that scenario is blunt: take PHP-based systems offline until they can be patched or updated. A web application firewall may provide some protection in the interim, but CISA frames it as partial mitigation, not a fix.
The patching priority is internet-facing systems first. That is standard triage for an unauthenticated RCE, and it applies here without qualification.
Detection and Partner Guidance
CISA released a SIGMA detection rule to help identify potentially suspicious activity tied to these vulnerabilities. The rule is available in CISA's SIGMA Rules GitHub repository, and CISA notes it may be updated as more information becomes available.
The response has been international. Partner advisories came from the United States National Security Agency, the United Kingdom's National Cyber Security Centre, the Australian Signals Directorate's Australian Cyber Security Centre, the Netherlands' NCSC, New Zealand's NCSC, and the Canadian Centre for Cyber Security. Each issued its own alert or guidance on the same CVE pair.
That breadth of coordination usually signals a vulnerability with real exploitation behind it, not a theoretical paper. The KEV Catalog addition on October 26 confirms exploitation is confirmed rather than suspected.
Why This One Is Hard to Patch Cleanly
The hard part is not the patch itself. It is finding every place PHP runs.
PHP hides inside other software. Hosting panels, control planes, monitoring agents, and commercial applications bundle PHP without advertising it. An inventory that checks installed packages may miss a bundled runtime sitting inside another vendor's directory tree. CISA explicitly calls out that PHP is often a component of other software and that prevalence may not be directly observable.
The practical answer is to scan for the binary and the module, not just the package manager. Check for mod_php in Apache configuration, PHP-FPM socket and service units, php-cgi wrappers, and FrankenPHP or LiteSpeed processes. Then check the version on each one. Reuters has covered the broader trend of runtime-level vulnerabilities hitting shared infrastructure, and this fits that pattern.
It's not clear the patching will outpace exploitation. KEV inclusion means attackers already have working exploit code, and PHP's footprint on the web is enormous. Organizations with mature patching pipelines will handle this in days. Everyone else is the target.
What Defenders Should Do This Week
The action list from CISA is short and specific. Identify and inventory systems running any version of PHP. Apply the patch immediately, prioritizing internet-facing systems. If you cannot update, or you run PHP 8.1 or earlier, take PHP-based systems offline until patched. Put a WAF in front as a bridge. Review the official PHP security advisory. Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
The monitoring piece deserves emphasis. Patching closes the door, but you still need to know whether someone walked through it before you patched. Check logs for the SIGMA rule indicators. Look for unusual child processes under PHP workers. If you find evidence of compromise, treat the server as breached, not just unpatched.
The forward-looking question is how many systems will still be unpatched next month. PHP's long tail of legacy installations, especially in hosting environments that bundle it invisibly, means this vulnerability will linger. The organizations that survive it cleanly will be the ones that treated inventory as a first-class security task, not an afterthought.
There is also a structural lesson here. PHP's release cycle ships security fixes across four active branches, which is good news for operators who track versions. The bad news is that the unsupported tail, PHP 8.1 and earlier, gets nothing. Those installations are not going to disappear on their own. They sit in shared hosting, in old appliances, and in internal tools that nobody wants to touch. Each one is a potential foothold until it is either patched or retired.
Defenders should treat this CVE pair as a forcing function for a broader runtime audit. If you find PHP 8.0 on a server today, you have a bigger problem than CVE-2026-109618. You have a system that is not receiving security updates at all. The php2shell flaws just made that fact expensive.
For more on this topic, see our cybersecurity coverage.