Ethical Hacking News
The PHP2Shell vulnerability has been added to the U.S. CISA's Known Exploited Vulnerabilities catalog, affecting all PHP versions that handle web requests. This critical vulnerability allows attackers to execute code remotely, and experts recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure. With a growing number of attacks reported, it is essential to prioritize vulnerability management and implement robust security measures to protect against such threats.
The PHP2Shell vulnerability affects all PHP versions from 5.4, released in 2012, and can be exploited remotely by sending specially crafted HTTP requests.A group of North Korea-linked actors has identified 216 hosts that may still be vulnerable to PHP2Shell, making it challenging to detect and respond to the attacks.The U.S. CISA has ordered federal agencies to fix the flaws by October 29, 2026, and recommends that private organizations review the catalog and address the vulnerabilities.Organizations should prioritize vulnerability management and implement robust security measures to protect themselves against PHP2Shell and similar threats.
The PHP2Shell vulnerability, recently added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, has left the web security community on high alert. This critical vulnerability, identified as CVE-2026-109618 and CVE-2026-109619, affects all PHP versions that handle web requests, dating back to PHP 5.4, released in 2012. The flaws allow attackers to execute code remotely by sending specially crafted HTTP requests, without authentication.
According to Cyfirma, a group of North Korea-linked actors has identified 216 hosts that may still be vulnerable to PHP2Shell. The operators communicate through a private I2P channel, and their scanning is slow on purpose, with a volume that stays low, machines rotating, and any node that shows filtering or rate limiting getting pulled and never reused. This behavior makes it challenging to detect and respond to the attacks.
The U.S. CISA has ordered federal agencies to fix the flaws by October 29, 2026, and experts recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure. The Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities states that FCEB agencies must address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
The emergence of PHP2Shell highlights the importance of keeping software up-to-date and patching critical vulnerabilities in a timely manner. The vulnerability's impact is further exacerbated by the fact that it affects all PHP versions, making it a widespread concern. As the web security landscape continues to evolve, it is essential for organizations to prioritize vulnerability management and implement robust security measures to protect themselves against such threats.
The PHP2Shell vulnerability serves as a reminder of the ever-present threat of exploitation in the digital world. As the security landscape continues to shift, it is crucial for individuals and organizations to remain vigilant and proactive in addressing emerging vulnerabilities. By staying informed and taking prompt action, we can minimize the risk of exploitation and ensure a safer online environment for all.
Related Information:
https://www.ethicalhackingnews.com/articles/The-PHP2Shell-Vulnerability-A-Growing-Concern-for-Web-Security-ehn.shtml
https://securityaffairs.com/201840/security/u-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-109618
https://www.cvedetails.com/cve/CVE-2026-109618/
https://nvd.nist.gov/vuln/detail/CVE-2026-109619
https://www.cvedetails.com/cve/CVE-2026-109619/
Published: Tue Oct 27 08:20:48 2026 by llama3.2 3B Q4_K_M
