The US Cybersecurity and Infrastructure Security Agency (CISA) has listed two critical security vulnerabilities in the PHP programming language, collectively known as PHP2Shell vulnerabilities, within its catalog of vulnerabilities exploited in actual attacks.
Vulnerability Details and Active Attacks
The two vulnerabilities, bearing the identifiers (CVE-2026-109618) and (CVE-2026-109619), allow unprivileged attackers to execute highly complex attacks aimed at remote code execution (RCE) on systems that have not received the necessary security updates. PHP security teams had released the necessary software updates to close the two vulnerabilities in October, following the detection of widespread exploitation attempts by several security companies before the public announcement.
Although vulnerability details were leaked and some proof-of-concept (PoC) codes were published online before the release of official patches, the PHP security team confirmed that those attempts were not initially effective. However, multiple security companies, including Amazon and Cloudflare, documented exploitation attempts targeting the vulnerabilities even a few days before the official updates were released.
Urgent Directives for Government Entities
Following these developments, CISA added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and mandated that Federal Civilian Executive Branch (FCEB) agencies secure their systems and apply the necessary patches in accordance with the binding operational directive (BOD 26-04). The agency warned that this class of vulnerabilities constitutes a common attack vector that directly threatens federal infrastructures and institutions.
What Does This Development Represent in Practice?
These updates are of paramount importance due to the widespread use of the PHP language, as VirusTotal platform estimates indicate that PHP powers approximately 70% of all websites globally, with millions of hosts at risk. This field action by the US agency and the rapid response of incident response teams reflect the necessity for technical organizations to adopt risk-based vulnerability management plans to immediately deal with any critical vulnerabilities confirmed to be exploited in the digital wild.