CISA has added the two PHP2Shell vulnerabilities to its KEV catalog and says they are being actively exploited in the wild.
Both flaws carry a CVSS score of 9.2 on the CVSS severity scale, the agency is advising firms to patch their systems as soon as possible.
The two flaws include CVE-2026-109618, which is a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability.
Both allow for unauthenticated remote code execution, and according to CISA, “these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.”
The agency also said that these flaws were both “known exploited vulnerabilities,” meaning threat actors are confirmed to be putting them to use against their targets. CISA did not outline which threat groups have been observed exploiting them
Still, CISA urged organizations to “adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.”
Both CVE-2026-109618 and CVE-2026-109619 are the PHP2Shell flaws that sent shockwaves through the industry last week. The vulnerability would allow an attacker to remotely execute code on a target machine, and it owed much of its seriousness to the huge number of websites that could be affected.
PHP powers roughly 70% of websites whose server-side language is known, according to W3Techs.
Organizations running PHP should update to versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, all of which mitigate the PHP2Shell flaw, and firms are strongly encouraged to patch exposed services as soon as they can.
As CISA’s warning attests, attackers are already exploiting unpatched systems.
