CISA adds two critical PHP2Shell flaws to its Known Exploited Vulnerabilities catalog, warning of active attacks. Both allow unauthenticated remote code execution. Here's what you need to know and do.
So, CISA just dropped some news that should make anyone running PHP sit up straight. On Monday, the agency added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. That means attackers are already using them in the wild. And with a CVSS score of 9.2, these aren't the kind of bugs you can ignore and hope for the best.
Both flaws allow unauthenticated remote code execution. In plain English: an attacker doesn't need a password or any special access. They can just send a crafted request and potentially run their own code on your server. Game over, right? Well, almost—if you haven't patched yet.
### What Exactly Are These Flaws?
We only have details on one of them so far: CVE-2026-109618. It's described as an out-of-memory condition. That might sound like a simple crash, but in the wrong hands, it can lead to much worse. When memory gets exhausted in a specific way, it can create an opening for code execution. The second vulnerability hasn't been detailed publicly yet, but CISA's action tells us it's just as serious.
These aren't theoretical risks. The KEV catalog is basically a hit list of vulnerabilities that attackers are actively exploiting. Once you're on it, you're a target.
### Why This Matters to You
If you're running PHP in production—and let's face it, a huge chunk of the web does—you need to take this seriously. The flaws were recently patched, so fixes are available. But patches only work if you apply them.
Here's the thing: unauthenticated RCE is about as bad as it gets. It means a stranger on the internet can take control of your server without any credentials. From there, they could steal data, install malware, or use your machine as part of a botnet. And because it's unauthenticated, automated scanners can find and exploit it at scale.
> "The moment a vulnerability lands on CISA's KEV catalog, it's no longer a question of if you'll be targeted—it's when."
That quote might be a bit dramatic, but it's not far off. Attackers move fast, and automated tools make it easy for even low-skilled criminals to exploit known issues.
### What Should You Do Right Now?
First, check if your PHP version is affected. The vulnerabilities were patched, so if you're running an older version, you're at risk. Update to the latest stable release immediately.
Second, if you can't patch right away (and you really should), consider temporary mitigations. A web application firewall (WAF) might block some attacks, but it's not a silver bullet. The only sure fix is applying the patch.
- Identify all systems running PHP.
- Check the PHP version on each system.
- Apply the latest security patches.
- Monitor for any unusual activity.
- Review logs for signs of exploitation attempts.
And don't forget about third-party libraries and frameworks—they often bundle their own PHP components. Make sure everything is up to date.
### The Bigger Picture
This isn't the first time PHP flaws have made headlines, and it won't be the last. The lesson is simple: keep your software updated, and don't wait for a warning to act. CISA's KEV catalog is a great resource—check it regularly. It's free, and it tells you exactly what attackers are going after.
So, take a few minutes today to verify your PHP versions. It's a small effort that could save you from a very bad day.
