cyber-crime

Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells

The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week.

CISA added CVE-2026-109618 and CVE-2026-109619 to i ts Known Exploited Vulnerabilities (KEV) catalog on Monday , setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild.

Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers.…