Ethical Hacking News
Critical PHP2Shell flaws have been confirmed to be actively exploited by threat actors, posing a significant threat to web applications and services that rely on PHP. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the two flaws to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the urgent need to address these vulnerabilities. Web application owners and administrators are advised to take immediate action to update their PHP versions, disable automatic HTTP response decompression in cURL, and monitor their systems for any signs of exploitation.
The world of web security has recently been shaken by the revelation of two critical PHP2Shell flaws, which have been confirmed to be actively exploited by threat actors.The two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution on affected deployments.The CISA has added these two flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating that they have been identified as being actively exploited by threat actors.PHP Foundation has released emergency patches for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the two identified vulnerabilities.32.51 million PHP services are still running an affected version, highlighting the importance of addressing these vulnerabilities.A vulnerability in the Brotli decoder library, CVE-2026-111497, has also been identified, which can result in privilege escalation and unauthenticated remote code execution.Web application owners and administrators must take immediate action to address these vulnerabilities by updating their PHP versions, disabling automatic HTTP response decompression in cURL, and monitoring their systems for signs of exploitation.
Critical PHP2Shell Flaws Exposed: A Threat to Web Security
The world of web security has recently been shaken by the revelation of two critical PHP2Shell flaws, which have been confirmed to be actively exploited by threat actors. These vulnerabilities, rated 9.2 on the Common Vulnerability Scoring System (CVSS) scale, pose a significant threat to web applications and services that rely on PHP, a server-side scripting language used by approximately 70% of all websites on the internet.
According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution on affected deployments. This means that an attacker can remotely execute arbitrary code on a vulnerable web application, potentially leading to unauthorized access, data tampering, or even complete control over the application.
The CISA has added these two flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating that they have been identified as being actively exploited by threat actors. The addition of these flaws to the KEV catalog serves as a warning to web application owners and administrators, highlighting the urgent need to address these vulnerabilities.
In an effort to mitigate the risks associated with these vulnerabilities, the PHP Foundation has released emergency patches for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These patches address the two identified vulnerabilities and provide a fix for the PHP2Shell flaws.
The severity of the vulnerabilities has prompted numerous advisories from software and security vendors, government agencies, and other organizations across the world. A total of 32.51 million PHP services are still running an affected version, which further underscores the importance of addressing these vulnerabilities.
Furthermore, the PHP Foundation has also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 to address CVE-2026-111497, an out-of-bounds write vulnerability in the Brotli decoder library that could result in privilege escalation and unauthenticated remote code execution. This vulnerability affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0, as well as other projects that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.
The PHP Foundation has noted that the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.
In light of these findings, it is essential for web application owners and administrators to take immediate action to address these vulnerabilities. This includes updating their PHP versions to the latest supported releases, disabling automatic HTTP response decompression in cURL, and monitoring their systems for any signs of exploitation.
In conclusion, the exposure of the critical PHP2Shell flaws highlights the importance of staying vigilant in the face of emerging web security threats. By taking proactive steps to address these vulnerabilities, web application owners and administrators can significantly reduce the risk of exploitation and protect their systems from potential attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-PHP2Shell-Flaws-Exposed-A-Threat-to-Web-Security-ehn.shtml
https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html
https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
https://nvd.nist.gov/vuln/detail/CVE-2026-111497
https://www.cvedetails.com/cve/CVE-2026-111497/
Published: Tue Oct 27 01:12:19 2026 by llama3.2 3B Q4_K_M
