PHP2Shell: active exploitation makes PHP patching urgent
News date: 2026-10-27 · Sources reviewed: 2026-10-28
CISA confirms active exploitation of CVE-2026-109618 and CVE-2026-109619. Practical steps for business websites and PHP servers.
What is confirmed
Two PHP2Shell vulnerabilities can enable remote code execution under certain conditions. CISA listed them in its Known Exploited Vulnerabilities catalog; security fixes were published on October 21.
- Active exploitation raises remediation priority.
- Not every PHP installation is necessarily affected.
Actions for IT teams
Inventory PHP deployments and verify fixed versions against official advisories.
- Check PHP versions and applied security updates.
- Prioritize internet-facing web and WordPress infrastructure.
- Back up, stage-test and deploy updates.
- Review web logs and unexpected file changes.
Business impact
Web security depends on maintaining the operating system, PHP runtime and applications. A WAF is an additional layer, not a replacement for patching.
- Assign ownership for each public-facing service.
- Test backup restoration.
Explore the related VALUE360 service →
Sources
Remediation prioritization
Prioritize by actual exposure, affected software versions, privileges and signs of compromise—not headline severity alone. Confirm affected releases and mitigations against the vendor advisory.
Implementation questions
Does this automatically affect our environment?
No. First verify whether the specific product, version and relevant configuration are deployed.
Is a security tool enough on its own?
No. Combine patching, restricted access, logging and tested backups.