CISA confirms attackers are exploiting both PHP2Shell flaws
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
CISA has added both PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalogue, requiring federal civilian agencies to patch by 29 October, though it has not named victims or detailed its evidence.