The US Cybersecurity and Infrastructure Security Agency (CISA) has added the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog. The listing, dated 26 October, means the agency now has evidence that attackers are exploiting the flaws, which sit in the PHP engine itself rather than in any single application.
CISA lists them as a "PHP Memory Corruption Vulnerability" and a "PHP Stale Internal Request-State Vulnerability". At the same time, the agency updated its existing alert on critical PHP vulnerabilities that require immediate patching.
The first official word that attacks are real
The timing matters. Until now, public reporting on PHP2Shell had described heavy probing but no proven break-ins. Only hours before CISA's update, we reported that Wordfence had blocked more than 74,000 exploit or probing attempts without observing a single confirmed compromise on the WordPress sites it protects. Earlier in the week, researchers had already seen attackers probing the bugs within hours of disclosure, alongside a flood of unvetted proof-of-concept code on GitHub.
CISA's catalog requires a CVE ID, evidence of exploitation and clear mitigation guidance before an entry is added. The agency's notice does not say who is exploiting PHP2Shell, against what targets, or how many systems have been hit, and it should not be read as confirming any particular campaign. What it does establish is that exploitation has moved beyond the theoretical, at least in the agency's assessment.
Both CVEs carry a CVSS v4.0 score of 9.2, according to their NVD records, and both have EPSS scores above 0.99, which puts them near the very top of the scale used to predict exploitation activity.
Who has to act, and by when
The listing binds US federal civilian agencies under Binding Operational Directive 26-04, which requires them to prioritise remediation of KEV entries on publicly exposed assets and sets expectations for checking whether a system was compromised before the patch went on. CISA encourages every other organisation to treat the catalog the same way.
Update PHP itself, not just the CMS
The PHP project shipped fixes on 21 October, as we covered when the patches went out. Updating WordPress, Drupal or Joomla does not fix this: the PHP runtime underneath has to be upgraded. Older, unsupported branches should be isolated or migrated. PHP has also advised turning off session.upload_progress.enabled until its next bugfix release to close one remaining code execution path its PHP2Shell patches do not cover.
Given that a fully patched application can still sit on a vulnerable interpreter, teams that patched only at the CMS layer should check again, and those that waited for proof of real attacks now have the official signal they were waiting for.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.