What happened
The US Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities known as "PHP2Shell" to its Known Exploited Vulnerabilities (KEV) catalogue. According to the agency's alert, the change was made on Monday.
Deadline is close
Federal civilian agencies are expected to patch CVE-2026-109618 and CVE-2026-109619 by Thursday, 29 October. Last week CISA warned about the flaws but said it had not yet observed exploitation.
Why it matters
Landing on the KEV list means a flaw is not just theoretical but used in real attacks. Because PHP runs across a vast server base, unpatched systems remain directly exposed.
What to do
Organisations running PHP-based systems should apply vendor patches without delay, track versions and check logs for signs of exploitation.
