The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting two critical vulnerabilities in PHP, a widely used web programming language, and ordered civilian federal agencies to secure affected systems by October 29, 2026. The vulnerabilities, collectively known as PHP2Shell, allow attackers to execute malicious code remotely without authentication, potentially exposing websites and applications to unauthorized access.
CISA added the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26. The agency did not identify the attackers or disclose which organizations had been compromised, although independent security researchers had previously reported evidence of exploitation.
PHP Security Flaws Affect Widely Used Web Infrastructure
The vulnerabilities received critical severity ratings of 9.2 out of 10 and affect PHP installations used to serve web requests. PHP powers a substantial share of websites and web applications, with estimates cited in reporting placing its usage at approximately 70% of web-facing servers.
The PHP development team released emergency security updates on October 21, addressing flaws that could allow attackers to manipulate memory handling and execute arbitrary code. The patches cover PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with administrators urged to update their systems immediately.
Despite the vulnerabilities’ critical ratings, security researchers initially found it challenging to develop reliable exploits. However, subsequent investigations uncovered successful attacks against vulnerable PHP installations, increasing concerns about unauthorized access, service disruption and potential data breaches.
Earlier Vulnerabilities Resurface Through AI-Assisted Research
The underlying memory-handling problems were identified during a 2024 security audit, but researchers initially lacked a practical method to exploit them. Work on a fix subsequently stalled because of technical challenges and limited development resources, according to the PHP Foundation’s official statement.
In 2026, security firm Calif identified exploitable attack paths during a security audit that incorporated AI-assisted research, while other researchers independently reported related findings. These discoveries prompted the PHP development team to prioritize patches for vulnerabilities that had remained unresolved for approximately two years.
The PHP Foundation acknowledged that its limited resources and decision-making processes contributed to the delay. The organization has since expanded its security team and adopted additional AI-based tools to help examine vulnerability reports, validate exploits and support security reviews.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.