CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface

TL;DR

On October 26, 2026, CISA added the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (CISA KEV) catalog. Federal agencies must patch by October 29. Meanwhile, a researcher confirmed full remote code execution in the wild, and CYFIRMA tied low-volume scanning to a suspected North Korea-linked operator.

Why It Matters

PHP runs a large share of the web. VirusTotal estimates put exposed PHP hosts at more than 5.1 million. Until now, much PHP2Shell activity looked like scanning and broken exploits. That picture has changed.

The CISA alert adding two known exploited vulnerabilities also updates its earlier PHP alert. CISA warns that “these types of vulnerabilities are a frequent attack vector for malicious cyber actors.”

Confirmed RCE in the Wild

Adel Karimi, detection and response lead at Perplexity, caught a working attack in his honeypots. The target was Apache mod_php running PHP 8.4.26. In a post on X detailing the PHP2Shell RCE evidence, he wrote: “This is now confirmed RCE with usable memory disclosure, not just a crash.”

Karimi also added a caveat. The setup was an “intentionally favorable single-worker mod_php profile,” so it does not measure reliability elsewhere.

Expel researcher Marcus Hutchins backed the finding. In his post on X confirming the exploitation, he called it “by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far.”

Before this, Dataminr’s TRACE team said activity was “limited to scanning, fingerprinting, and use of non-working exploits.”

Suspected DPRK Campaign

CYFIRMA reports a separate campaign probing PHP servers from 21 compromised nodes. According to the CYFIRMA advisory on suspected DPRK PHP2Shell targeting, the operators picked 216 unpatched or partly mitigated hosts.

The targets sit in the U.S., Japan, South Korea, Australia, the E.U. and several other regions. They include government, banks, airports and online payment platforms. CYFIRMA links the activity, with moderate confidence, to an operator affiliated with the Lazarus Group ecosystem. “Exploitation is the next step,” the firm warned.

How the Attack Works

PHP2Shell abuses memory corruption in PHP’s request handling. CVE-2026-109618 corrupts memory during out-of-memory handling. CVE-2026-109619 reuses stale state between requests. Both can lead to code execution as the web worker account.

Brotli fix for Windows builds

Separately, the PHP team released Windows rebuilds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. As the PHP announcement on updated Windows builds explains, they bundle Brotli 1.2.1 to fix CVE-2026-111497. The bug is reachable through cURL when automatic response decompression is on, which is off by default.

Affected Versions

PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. PHP 8.1 and older get no official fixes.

Patch and Mitigation Steps

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart all workers.
• On Windows, install the new -1 builds to pick up the Brotli fix.
• Use CISA’s SIGMA rule to hunt for PHP2Shell exploitation attempts.
• Review logs back to October 17, when Amazon saw the first attacks.

With PHP2Shell now in the CISA KEV catalog and confirmed RCE on record, unpatched servers face real risk.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.