Federal cybersecurity officials order swift patches as hackers target PHP2Shell bugs

The Cybersecurity and Infrastructure Security Agency added two critical PHP vulnerabilities, known as PHP2Shell, to its Known Exploited Vulnerabilities catalog on Monday. The agency directed federal civilian agencies to patch the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, by an October 29 deadline. Both vulnerabilities carry a 9.2 CVSS severity rating and allow unauthenticated threat actors to remotely execute code on unpatched web servers. [1][2]

While early detection reports from firms like Sophos and Palo Alto Networks were walked back or marked unsuccessful, Delft University's Threat Intelligence Lab has tracked more than 50,000 exploitation requests from over 600 IP addresses. Administrators are advised to update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. [1][2]

The flaws pose an extensive risk because PHP powers roughly 70% of all websites, with VirusTotal estimating that 3.8 million internet-facing instances have at least one port open to attacks. Amazon Threat Intelligence noted that attackers were attempting exploits as early as October 17, four days prior to the public disclosure and official patch release on October 21. [1][2]