The U.S. Cybersecurity and Infrastructure Security Agency added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, 2026, confirming exploitation of flaws that can let attackers run code without authentication on affected PHP deployments.
CISA’s alert identifies CVE-2026-109618 and CVE-2026-109619. Both carry CVSS v4.0 scores of 9.2. The flaws were disclosed on October 21, according to Siemens; the catalog addition does not establish when exploitation began.
The Hacker News reported that PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that federal agencies have until October 29 to apply them. CISA says its binding vulnerability-management directive applies to Federal Civilian Executive Branch agencies, while encouraging other organizations to prioritize cataloged vulnerabilities.
What the exploitation evidence shows
The vulnerabilities involve PHP’s handling of memory used for web requests. According to Arista’s technical advisory, CVE-2026-109618 can leave request memory uninitialized after an out-of-memory error, allowing request cleanup to read or act on it. CVE-2026-109619 involves internal state that can continue pointing to request memory after that memory has been freed. Both conditions can lead to remote code execution.
The Hacker News cited Adel Karimi, detection and response lead at Perplexity, as confirming successful code execution against honeypot systems on October 24. Karimi reported an 800 KiB decoded cookie dump and said a function address derived from it using the public exploit’s offsets appeared in a subsequent execution payload.
That finding has a specific limit: Karimi said the demonstrated chain used an intentionally favorable single-worker mod_php configuration. It does not measure exploit reliability across other worker counts, PHP builds or applications. The observed memory disclosure and execution therefore establish what happened on those honeypots without establishing the same outcome for every affected deployment.
Product-specific status changes the required action
Arista’s advisory, updated October 26, says no Arista software products or platforms remain affected. CloudVision CUE cloud service delivery and Arista Edge Threat Management were affected but have already received corrected PHP versions. Arista says the affected cloud services are remediated and customers need take no action. It also says it is unaware of malicious exploitation in customer networks.
Siemens identifies a different affected scope in advisory SSA-566512: all RUGGEDCOM APE1808 versions running Palo Alto Networks PAN-OS in the 10.2, 11.1, 11.2, 12.1 and 12.2 release trains. Customers should contact support for patch and update information and implement the workarounds in Palo Alto Networks’ upstream security notifications, Siemens says.
That exposure does not extend to every Siemens product. Its separate software advisory, updated October 26, lists products including Teamcenter, Solid Edge, Capital and the specified Opcenter products as unaffected because they do not use PHP.
Separate Brotli fixes for PHP Windows builds
The Hacker News also reported PHP Foundation Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, released by October 26 to address a separate Brotli decoder out-of-bounds write, CVE-2026-111497. These builds address an additional vulnerability beyond the two exploited PHP2Shell flaws.
According to the PHP Foundation statement quoted in that report, the vulnerable decoder is reachable through PHP’s cURL extension when automatic HTTP response decompression is enabled. That setting is disabled by default in cURL, but applications and HTTP client libraries can enable it.
Microsoft’s advisory for CVE-2026-111497 describes the .NET impact as elevation of privilege over a network and marked it as not exploited at original publication. For .NET and ASP.NET Core, Brotli decompression is also disabled by default: applications must opt into request or response decompression, or invoke the Brotli decompression APIs directly. CISA’s exploitation confirmation concerns the two PHP2Shell vulnerabilities, not this separate Brotli flaw.
