Vulnerability / Web Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities ( KEV ) catalog.

The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments -

CVE-2026-109618 - An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

CVE-2026-109619 - A stale internal request-state vulnerability that allows for unauthenticated remote code execution.

The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said .…