CISA Adds Two PHP2Shell Vulnerabilities to Known Exploited Catalog, Active Exploitation Confirmed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of two PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments.

CISA added the flaws to the KEV catalog on 2026-10-27. The agency did not assign individual CVE numbers in the public announcement, but the source identifies CVE-2026-109618 as one of the flaws. The summary references two PHP2Shell flaws, though only one CVE ID is listed in the source data. Both vulnerabilities affect PHP2Shell, a PHP-based shell often used for server administration.

Successful exploitation could allow unauthenticated threat actors to execute arbitrary code on targeted systems, potentially leading to full system compromise. CISA recommends that organizations using PHP2Shell apply the latest security updates from the vendor without delay. The KEV catalog inclusion signifies that active exploitation has been confirmed and that the vulnerabilities pose a significant risk to federal civilian executive branch systems and beyond.