The CISA PHP2Shell warning confirms that hackers are actively exploiting two critical vulnerabilities in PHP, a widely used website programming language. The U.S. Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to address affected systems by October 29.
On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. The agency’s official alert confirms that attackers are exploiting both flaws. Successful attacks can let hackers run malicious code on vulnerable servers without passwords.
CISA PHP2Shell Warning Confirms Active Exploitation
The PHP project released emergency security patches on October 21, five days before CISA’s latest warning. At the time, researchers warned that exploitation was possible but technically challenging.
Since then, security investigators have documented successful attacks against vulnerable test environments. A published honeypot investigation includes evidence of remote code execution on deliberately exposed PHP servers.
The findings demonstrate that attackers can exploit the vulnerabilities under certain conditions. However, they do not establish how many production websites have been compromised.
TechAmerica.ai previously reported on the emergency PHP2Shell patches and website disruptions following the initial disclosure. CISA’s new confirmation increases the urgency for organizations that have not updated their systems.
Federal Agencies Must Patch by October 29
The vulnerabilities affect PHP’s internal memory handling and request-processing mechanisms. CVE-2026-109618 involves memory corruption, while CVE-2026-109619 concerns stale internal request data.
Both flaws can potentially give attackers control of affected systems. Vulnerable configurations include Apache with mod_php, PHP-FPM and other common PHP deployment environments.
Security fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators running older releases should upgrade or obtain verified security fixes from their software providers.
CISA recommends prioritizing internet-facing systems and investigating potential compromises. Organizations should examine server logs for suspicious commands, unusual processes and unauthorized network activity.
Updating a content management system alone may not resolve the problem. Website operators must also ensure the underlying PHP installation is patched.
PHP Security Problems Expose Open-Source Funding Gaps
The incident has renewed concerns about maintaining software that supports large portions of the internet. Major content management systems and countless business applications use PHP.
According to a Reuters report, the PHP Foundation operates with one full-time employee and 14 mostly part-time contractors. Executive Director Elizabeth Barron said it relies on donations and grants.
AI-assisted security research helped uncover practical exploitation methods for the vulnerabilities. However, Barron also noted that AI-generated code has increased maintainers’ workload when reviewing software changes.
The foundation’s limited resources raise questions about the long-term security of widely deployed open-source infrastructure. For organizations using PHP, the immediate priority remains installing verified updates and checking for signs of compromise.
