The Cybersecurity and Infrastructure Security Agency (CISA) added two critical flaws in the PHP programming language to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26 and gave federal civilian executive branch agencies until Oct. 29 to remediate them.
The vulnerabilities – CVE-2026-109618 and CVE-2026-109619 – could allow attackers to remotely execute malicious code on affected web servers without authentication. Both carry severity scores of 9.2 out of 10 and affect widely used versions of PHP, an open-source programming language that powers websites and web applications.
The additions escalate the federal response to vulnerabilities that CISA urged organizations to patch immediately on Oct. 21. The agency’s KEV entries require remediation under Binding Operational Directive (BOD) 26-04 and call for forensic triage of affected systems. The BOD prioritizes security updates based on risk.
The Oct. 29 deadline leaves agencies little time to finish identifying vulnerable PHP installations, deploy updates, and investigate whether attackers may have gained access before systems were secured.
CISA’s decision to add the vulnerabilities to its catalog indicates evidence of active exploitation, although cybersecurity researchers have reported a limited picture of successful attacks.
In an Oct. 23 analysis, CrowdStrike said it had not observed successful exploitation of the vulnerabilities, collectively dubbed PHP2Shell, in the wild or in its honeypot environments. The company said it had primarily seen testing, probing, and unsuccessful exploitation attempts.
CrowdStrike explained that turning publicly available proof-of-concept code into a reliable attack requires adapting an exploit to a target’s specific PHP version, application, and supporting software. Those technical obstacles could slow widespread exploitation. CrowdStrike said developing a universal exploit that works across PHP deployments is unlikely, but attackers could create reliable exploits targeting specific configurations, including widely deployed container images.
Cisco Talos warned last week that exploitation attempts could increase as more sophisticated threat actors incorporate the vulnerabilities into their tools.
For federal agencies, the distinction between attempted and confirmed successful exploitation does not diminish the urgency of remediation. The KEV deadline requires agencies to address the vulnerabilities and determine whether potentially affected systems show signs of compromise.
That task could extend beyond agency-managed web servers. PHP is embedded in numerous applications and hosting environments, making it necessary to identify affected software, coordinate with contractors and service providers, and verify that updates reach the systems actually running vulnerable code.
“Most systems are a complex, interconnected mix of software, making monitoring and patching more difficult,” noted Travis Rosiek, public sector chief technology officer at Rubrik.
Emergency patching is necessary, but it does not ensure systems are secure, Rosiek added.
“Closing a vulnerability does not remove an attacker or rogue AI agent that has gained access,” Rosiek said. “Organizations need clear answers about who owns patching for each system and how they validate that patches have been applied,” he said.
Thi Nguyen-Huu, CEO of cybersecurity company WinMagic, said agencies should also examine how they protect credentials and active user sessions, particularly if attackers gained access before vulnerable systems were patched.
“The update locks the door, but it doesn’t throw out the malware already inside,” Nguyen-Huu said.
Nguyen-Huu warned that a compromised server could expose password files and session tokens that attackers could use to impersonate legitimate users. He advocated for cryptographic authentication methods that keep private keys on users’ devices rather than storing reusable authentication secrets on servers.
“The server holds no secret that signs anyone in, and a public key gives a thief nothing,” he said.
PHP developers released fixes on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CrowdStrike recommended prioritizing internet-facing applications, rebuilding affected container images, and restarting Apache and PHP processes after updates.