CISA confirms active exploitation of PHP2Shell RCE flaw

What Happened

The U.S. Cybersecurity and Infrastructure Security Agency on Monday added the recently patched PHP2Shell flaws to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are actively exploiting them in the wild. The KEV listing centers on CVE-2026-109618, a PHP out-of-memory (OOM) handler remote code execution issue. The addition carries a critical severity rating and triggers binding operational directive requirements for federal civilian agencies.

The KEV designation is significant because CISA does not add vulnerabilities on speculation. Placement means the agency has corroborated exploitation through incident reporting, vendor telemetry, or third-party research. The PHP2Shell flaws were patched before the KEV addition, meaning a fix has been available while exploitation was already underway.

Why It Matters

PHP underpins a large share of the web, from CMS platforms to custom APIs and internal tooling. A remotely exploitable code execution path in the runtime itself, rather than in a single application, gives attackers a broad target set that cuts across industries and hosting providers. The KEV listing also signals that exploitation is not theoretical or limited to a single targeted campaign.

For federal agencies, KEV placement starts a remediation clock under BOD 22-01, generally requiring patching within a defined window. For everyone else, it is a strong prioritization signal: this is no longer a “patch when convenient” item.

Technical Details

The core issue is a memory management flaw reachable through PHP’s out-of-memory handling path, which can be manipulated to achieve remote code execution. The “PHP2Shell” naming reflects attacker behavior: leverage the runtime flaw to spawn a shell and move to follow-on activity. Two related flaws were patched as a set, and both are now treated as exploited.

Public proof-of-concept material has circulated, lowering the bar for opportunistic attackers who can adapt existing scripts rather than develop exploits from scratch. The attack vector is network-reachable, and exploitation does not require authentication in the typical case. Detection is difficult because a successful exploit may resemble normal application errors or resource exhaustion before the payload executes.

Immediate Risk

Treat any internet-facing PHP deployment running a version below the patched release as exposed. Priority targets include shared hosting environments, multi-tenant applications, and edge services that proxy to PHP backends. Organizations should check their PHP version inventory now, confirm the patched build is deployed, and review logs for abnormal OOM events or unexpected process spawning by the web server user. The PHP OOM handler advisory contains the affected version detail.

Security Insight

The instructive parallel is the log4j era lesson inverted: here the vulnerability lives in the interpreter, not a logging library, but the exposure pattern is the same. Organizations rarely have a complete inventory of every PHP runtime they operate, especially embedded in third-party appliances and forgotten subdomains. The KEV clock rewards those who can answer “what PHP versions do we run, and where” within hours. Building that runtime inventory is more valuable than any single patch cycle, because the next interpreter-level flaw will arrive on the same schedule.

Further Reading

• PHP OOM handler RCE exploited in the wild (CVE-2026-109618) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports