CISA Adds PHP2Shell RCE Flaws to Active Exploitation List as 32 Million Servers Sit Unpatched

CISA has added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming what security researchers had already seen playing out in the wild. Both flaws carry a CVSS score of 9.2 and allow unauthenticated remote code execution. That combination should make anyone running a PHP server sit up and pay attention.

The two CVEs in question, CVE-2026-109618 and CVE-2026-109619, cover an out-of-memory corruption bug and a stale internal request-state issue respectively. Neither requires authentication to exploit. That is about as bad as it gets.

Confirmation of real-world exploitation came from Adel Karimi, detection and response lead at Perplexity, who observed successful RCE against honeypot systems on October 24. His findings were unambiguous: "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload."

Karimi was careful to scope his findings. The demonstrated chain relied on a single-worker mod_php configuration, which is about as favourable as it gets for an attacker. Real-world reliability across different PHP builds, worker counts, and application stacks is a separate question. That caveat is worth remembering, but it is not a reason for complacency.

Patched versions were released on October 21, covering PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Federal agencies have a deadline of October 29 to apply those fixes. Everyone else should treat that deadline as a reasonable benchmark rather than someone else's problem.

The scale of exposure here is significant. PHP runs on something close to 70% of all websites, and Censys estimates over 32.5 million PHP services are still running a vulnerable version. That is a very large attack surface for a pair of critical, actively exploited bugs with public exploit code circulating.

The vendor advisory pile has grown accordingly. ABB, Arista Networks, Broadcom, Canon, Citrix, Craft CMS, Dell, Drupal, F5, Hikvision, HP, HPE, Hitachi Energy, Huawei, IBM, Ivanti, Johnson Controls, Mitel, NETGEAR, Okta, QNAP, Rockwell Automation, Salesforce, Schneider Electric, Siemens, SonicWall, Splunk, Synology, Veeam, WordPress, and others have all issued their own advisories. When that many vendors start publishing guidance simultaneously, it is usually a sign that the blast radius is genuinely broad.

There is also a third issue worth flagging. On October 26, the PHP Foundation released Windows builds addressing CVE-2026-111497, a separate out-of-bounds write vulnerability in the Brotli decoder library. This one goes by several names in the wild, including Broccoli2Shell, HTTP2Shell, and Node2Shell, and affects Brotli versions 1.0.3 through 1.2.0. It has been patched in versions 1.0.10, 1.1.1, and 1.2.1.

On Windows PHP builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. That setting is off by default in cURL, but plenty of applications and HTTP client libraries turn it on. The same vulnerability affects Node.js, Bun, Envoy Proxy, Istio, .NET, and Python, so the scope extends well beyond PHP.

Patch now. If you are waiting to see how serious this gets, you have already had your answer.