Executive Summary
CISA added the critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) Catalog following confirmation of in-the-wild exploitation. In-the-wild RCE was confirmed after honeypot activity recorded successful exploitation against an Apache mod_php installation running PHP 8.4.26. This represents an escalation from earlier reporting in which Cloudflare, Amazon, Hadrian, watchTowr, Previdian, and Patchstack observed widespread exploitation attempts but had not confirmed successful code execution. As previously reported by the RH-ISAC Intelligence Team, PHP released emergency security updates on 21 October 2026.
