CISA Orders Federal Patching After PHP2Shell Flaws Hit Governments

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. civilian federal agencies to patch two critical PHP programming language vulnerabilities, known as PHP2Shell, within three days. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to remotely execute malicious commands on web servers without passwords. CISA has since added the vulnerabilities to its Known Exploited Vulnerabilities list.

These bugs existed in the code for over a decade and affect approximately 70% of web-facing servers. While the PHP foundation previously viewed the flaws as impractical to exploit, researchers at Calif discovered a method to weaponize them using an AI model. This AI-driven acceleration has shortened the window between disclosure and exploitation. Security researcher Adel Karimi documented successful command executions on October 24, while reports indicate the vulnerabilities have already disrupted several Australian government websites, including the Australian Signals Directorate.

PHP developers released emergency patches across versions 8.2 through 8.5 to mitigate the risk. To avoid system downtime, some organizations are employing virtual patching provided by firms like TrendAI. While Wiz research suggests many exploitation attempts have failed due to memory limits, the rapid weaponization of the decade-old bugs has triggered widespread emergency security efforts globally.