CISA confirms both PHP2Shell flaws are being actively exploited
The US Cybersecurity and Infrastructure Security Agency (CISA) has added both PHP2Shell flaws to its Known Exploited Vulnerabilities catalogue. The change was announced on Monday, and federal civilian agencies have until Thursday, 29 October, to fix CVE-2026-109618 and CVE-2026-109619.
