CISA Confirms Active Exploitation of PHP2Shell RCE Flaws (CVE‑2026‑109618)

What happened

The Cybersecurity and Infrastructure Security Agency (CISA) officially listed two PHP2Shell flaws in its Known Exploited Vulnerabilities (KEV) program. Both vulnerabilities score 9.2 on the CVSS scale and enable unauthenticated remote code execution on any PHP deployment that includes the vulnerable module. The primary CVE, CVE‑2026‑109618, is an out‑of‑memory condition that attackers can trigger to execute arbitrary commands. Although patches have been released, CISA reports that threat actors are already exploiting these flaws in the wild, raising the risk of system compromise and data exposure for any unpatched PHP environment.

Why it matters for trust and compliance

• The incident tests the control objective of robust vulnerability and patch management—ensuring timely remediation and auditable evidence, a control that maps to many frameworks such as NIST CSF Identify‑ID.BE‑5.
• Demonstrates the need for continuous vulnerability scanning and evidence collection for audit readiness.
• Highlights the importance of rapid patch deployment and documented remediation in third‑party risk assessments.

Who is affected

Recommended actions

1. Apply the latest PHP patches that remove the PHP2Shell component across all environments.
2. Run an automated scan for CVE‑2026‑109618 and capture remediation evidence for auditors.
3. Update incident‑response playbooks to include containment steps for unauthenticated RCE.

Details

CVEs

CVE-2026-109618