Ethical Hacking News
Security experts are warning of the dangers of unpatched PHP2Shell vulnerabilities, as attackers exploit the flaws and threaten web applications worldwide. CISA has confirmed the vulnerabilities and urged federal agencies to patch the bugs by October 29. Will your organization be ready to protect itself from the PHP2Shell threat?
Attacks are exploiting two critical PHP vulnerabilities, PHP2Shell, which can be exploited without authentication to run code on vulnerable servers.The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the Common Vulnerability Scoring System (CVSS) scale.CISA has confirmed the exploitation of these vulnerabilities and is urging federal agencies to patch the bugs by October 29.Successful shell executions and exploitation requests have been reported from over 600 IP addresses across 70 countries.CISA is urging organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address the vulnerabilities.
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are exploiting two critical vulnerabilities in PHP, known as PHP2Shell, and has warned federal agencies to take immediate action to patch the bugs. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the Common Vulnerability Scoring System (CVSS) scale and can be exploited without authentication to run code on vulnerable PHP servers.
The confirmation comes amid growing evidence that attackers are actively exploiting the vulnerabilities, with researchers and threat intelligence firms reporting successful shell executions and exploitation requests from over 600 IP addresses across 70 countries. In one notable incident, a security researcher from Perplexity security recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php.
CISA has added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild.
The PHP2Shell vulnerabilities are a significant concern, given the widespread use of PHP in web applications and the potential for exploitation. According to CISA, attackers can exploit the vulnerabilities without authentication, which means that even if an attacker is unable to gain access to a PHP server, they can still attempt to execute malicious code on the server.
The CISA warning is part of a growing trend of cyber attacks targeting PHP applications. In recent weeks, there have been reports of successful PHP2Shell attacks, including a notable incident in which a German far-right party's email hosting provider was compromised, resulting in the exposure of 345,000 accounts.
To address the vulnerabilities, CISA is urging federal agencies to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. For federal agencies, the deadline is October 29, but CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them.
The exploitation of PHP2Shell vulnerabilities highlights the ongoing threat of cyber attacks targeting web applications and the importance of patching vulnerabilities in a timely manner. As CISA warns, the deadline for patching the PHP2Shell vulnerabilities is rapidly approaching, and organizations must take immediate action to protect their systems from exploitation.
Related Information:
https://www.ethicalhackingnews.com/articles/CISA-Confirms-Widespread-Exploitation-of-PHP2Shell-Vulnerabilities-Urges-Prompt-Patching-ehn.shtml
https://www.theregister.com/cyber-crime/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/5305681
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
Published: Tue Oct 27 09:49:57 2026 by llama3.2 3B Q4_K_M
