CISA Confirms Active Exploitation of Critical PHP2Shell RCE Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting two critical PHP2Shell vulnerabilities, both enabling unauthenticated remote code execution (RCE). The agency added these flaws to its Known Exploited Vulnerabilities (KEV) catalogue on Monday.

Both vulnerabilities carry a CVSS severity score of 9.2, indicating a critical risk level. One of the identified flaws is tracked as CVE-2026-109618, described as an out-of-memory vulnerability. The second flaw, also leading to RCE, was not specifically named in CISA’s alert but is associated with the same software.

The active exploitation confirmation from CISA serves as a critical warning for organisations running PHP2Shell deployments. Remote code execution vulnerabilities allow attackers to run arbitrary code on affected systems, potentially leading to full system compromise, data theft, and further network intrusion.

While CISA has confirmed active exploitation, the agency’s alert also notes that the PHP2Shell flaws have been recently patched. System administrators and cybersecurity teams are urged to apply these security updates immediately to protect their deployments from ongoing attacks.

Organisations subject to CISA’s Binding Operational Directive 22-01 are required to remediate vulnerabilities added to the KEV catalogue within specific deadlines. However, given the confirmed active exploitation, all users of affected PHP2Shell software should prioritise patching without delay, regardless of mandatory directives.