Update, Oct. 28: Palo Alto Networks now says in its security advisory that it has seen active exploitation of these flaws targeting PAN-OS firewall management interfaces exposed to the internet, and it has raised the issue's severity to Critical. When this story was first published, the company said it knew of no malicious exploitation against its products.
The Cybersecurity and Infrastructure Security Agency (CISA) added the two critical PHP flaws known as PHP2Shell to its list of vulnerabilities known to be exploited by attackers Monday, giving federal civilian agencies until Thursday, Oct. 29, to secure affected systems, the agency said in an alert. BleepingComputer reported that CISA shared no details of the attacks. The listing is the U.S. government's first formal finding that the bugs in PHP, the programming language behind much of the web, are being used in real attacks, and it sets a benchmark for how fast any organization with internet-facing PHP should move.
What Happened
The Known Exploited Vulnerabilities catalog now lists CVE-2026-109618, an out-of-memory corruption flaw, and CVE-2026-109619, a stale global-state flaw. Both allow unauthenticated remote code execution, meaning an attacker with no login can run commands on the server. Both were added Oct. 26 with an Oct. 29 due date.
CISA ordered agencies to act under Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," which requires fast fixes for listed flaws on internet-facing systems and, where CISA calls for it, a forensic check of whether a system was compromised before it was patched. The directive binds only federal civilian agencies, but CISA urges all organizations to prioritize the catalog.
CISA's Oct. 21 alert, "Critical Vulnerabilities in PHP Require Immediate Patching," tells organizations to inventory every system running any version of PHP and to apply the patch or take PHP systems offline if they cannot be updated right away, The Record reported. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What the Listing Does and Does Not Show
The listing confirms exploitation; it does not identify who was hit. No compromised organization has been named, according to BleepingComputer. On Oct. 23, CISA said it had not seen successful exploitation, SecurityWeek reported. The next day, a researcher's decoy servers logged 35 working attacker shells, as The Primary Wire reported Monday. An earlier Primary Wire report of a break-in at a European government body was corrected after Palo Alto Networks' Unit 42 research team withdrew its account.
Cloudflare Chief Executive Matthew Prince told Reuters he had anecdotal evidence of compromises linked to the PHP bug, according to a copy of the report published by Carrier Management. France's government cyber emergency team, CERT-FR, said in its Oct. 26 weekly bulletin that it was aware of proof-of-concept code and exploitation attempts.
Why It Matters
PHP runs about 70% of websites, and VirusTotal estimates more than 5.1 million PHP hosts are exposed online, BleepingComputer reported. Those figures measure exposure, not victims. The harder problem for boards is PHP they cannot see. It is often built into other products, and SecurityWeek reported Oct. 26 that industrial suppliers including Schneider Electric, Siemens and ABB have found affected products.
The directive's compromise check matters too. Amazon's threat intelligence team said targeting began four days before the Oct. 21 patches, BleepingComputer reported, so a system patched promptly may still have been entered first. Leaders should ask whether their PHP inventory covers vendor appliances and whether patched servers were checked for intrusions.
What to Watch
- Oct. 29 deadline: Whether agencies meet it, and whether CISA or others publish attack details or victims.
- Palo Alto fixes: The company's remaining hotfixes for its PAN-OS firewall software are estimated through Oct. 30. Palo Alto now reports active exploitation against exposed management interfaces.
- The third flaw: PHP has not yet fixed CVE-2026-115560, a separate remote code execution bug that needs an unusual setup. Its Oct. 23 guidance is to set session.upload_progress.enabled=0 until the next regular release; CERT-FR rates exploitation unlikely.
