WORLDTECHCISA Adds Two PHP2Shell Flaws to Exploited-security flaws Catalog After Honeypot Attacks
The US Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of two recently patched PHP2Shell flaws that allow unauthenticated remote code execution, listing both in its Known Exploited Vulnerabilities catalog. The move follows reports of successful attacks against honeypot systems.
Agency lists flaws as actively exploited
On Monday, the Cybersecurity and Infrastructure Security Agency confirmed that the recently patched PHP2Shell flaws are being actively exploited, adding both to its Known Exploited Vulnerabilities catalog.
Federal agencies have until October 29, 2026 to apply the necessary fixes.
Honeypot attacks and the two vulnerabilities
The listing comes after Adel Karimi, detection and response lead at Perplexity, reported successful remote code execution, meaning running programs on a machine from somewhere else, against honeypot systems on October 24, 2026. Karimi said the evidence now shows remote code execution with usable memory disclosure, not merely a crash followed by a suspicious process.
Both flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS scoring system. The first is an out-of-memory corruption vulnerability, the second a stale internal request-state vulnerability, and each allows unauthenticated remote code execution on affected deployments.
Karimi also cautioned that his evidence reflects an intentionally favourable single-worker mod_php profile and does not measure how reliably the exploit works with other worker counts, PHP builds or applications.
Fixes released and wider exposure
Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. PHP is a server-side scripting language used on roughly 70 percent of websites.
According to estimates shared by Censys, more than 32.51 million PHP services still run an affected version. A separate Brotli decoder vulnerability, also called Broccoli2Shell, HTTP2Shell and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0 and 1.2.0 and has been patched in versions 1.0.10, 1.1.1 and 1.2.1. The PHP Foundation said the vulnerable decoder on Windows builds can be reached through the cURL extension when automatic HTTP response decompression is enabled, a setting disabled by default.
Open questions
- How many affected PHP systems have been compromised in practice?
- Will the Brotli-related vulnerability also be added to the catalog?