CISA Adds PHP2Shell Vulnerabilities to Known Exploited Catalog, Orders Federal Patching
Federal agencies directed to remediate actively exploited flaws in PHP2Shell web shell
Key Takeaways
- CISA has added PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
- Federal agencies are under a binding operational directive to patch affected systems by a specified deadline.
- Active exploitation of the vulnerabilities has been confirmed in the wild.
- Broader internet-facing PHP2Shell deployments beyond the federal scope are also at risk.
Quick answers
- What happened?
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Federal civilian executive branch agencies are required to patch affected systems by a specified deadline due to confirmed active exploitation in the wild.
- Which products are affected?
- PHP2Shell
- What should defenders do?
- Apply vendor-supplied patches for PHP2Shell immediately. Prioritize remediation on federal civilian executive branch systems per CISA directive, and assess internet-facing deployments for similar exposure.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added PHP2Shell vulnerabilities to its catalog of actively exploited security flaws. In a binding operational directive, CISA ordered federal agencies to patch their systems by a designated deadline. The addition to the KEV catalog follows confirmation that the vulnerabilities are being actively exploited in attacks targeting PHP2Shell installations. The directive applies to federal civilian executive branch systems, though broader internet-facing deployments of PHP2Shell are also considered at risk. CISA did not disclose specific technical details of the flaws in the advisory, but emphasized that remediation is required to prevent further compromise.
Security Details
PHP2Shell vulnerabilities have been confirmed as actively exploited in the wild. CISA has added them to the KEV catalog and issued a binding operational directive for federal agencies to patch affected systems by a specified deadline.
Affected products
PHP2Shell
Mitigation
Apply vendor-supplied patches for PHP2Shell immediately. Prioritize remediation on federal civilian executive branch systems per CISA directive, and assess internet-facing deployments for similar exposure.
Sources
BleepingComputer
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
Oct 27, 2026 · 08:20
Original link
Related Security News
Logic Bug Chain Bypasses Microsoft Edge Sandbox, Researcher Details Exploit Method
Security researcher Orange Tsai of DEVCORE published a detailed analysis of a sandbox escape chain consisting entirely of logic flaws in Microsoft Edge. The chain, which won $175,000 at the Pwn2Own Berlin contest in May 2026, demonstrates that logic bugs alone can bypass Edge's isolation mechanisms and execute code on the underlying Windows system. Microsoft patched the vulnerabilities the day after the contest.
