Skip to content
CHRONOSAlerts
Cybersecurity & InfrastructureUrgency level L4SevereActiveGlobal
CHRONOS Cybersecurity & Infrastructure category illustration. Illustrative only, not specific to this event.
CHRONOS VisualizationCybersecurity & Infrastructure illustration, not specific to this event

CISA adds CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") to KEV; CISA confirms active exploitation

Event summary

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog (Tenable: "Update October 26: CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV catalog.") and reporting states CISA confirms the PHP2Shell flaws are being exploited in attacks (BleepingComputer: "CISA confirms PHP2Shell vulnerabilities now exploited in attacks."). CISA is urging organizations to immediately patch affected PHP installations (GovDelivery: "CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.").

CHRONOS Wire · October 27 · Alert 7

1:35
Publication details
Published
Updated
Revision
r1
Source
Tenable
Urgency
4/5
Severe
88/100
VERY HIGH
80/100
HIGH
100/100
VERY HIGH
30/100
LOW
85/100
VERY HIGH

Cliff Notes

  • KEV addition (Oct 26) + CISA confirmation of exploitation → urgent patching required.

U.S. Impact

U.S. Impact assessment pending.

ELI5: Plain-English Explanation

CISA added two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”) to its Known Exploited Vulnerabilities list on October 26, and CISA and reporting say the flaws are being exploited. CISA is urging organizations to patch immediately.

Why Urgent Level 4

CISA's KEV listing plus confirmation that the vulnerabilities are being exploited indicate elevated immediate risk to exposed PHP systems; CISA and others are urging immediate patching or mitigation.

What Changed

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog (noted by Tenable on October 26), and media reporting states CISA confirms these vulnerabilities are being exploited in active attacks.

What Is Genuinely New

CISA moved CVE-2026-109618 and CVE-2026-109619 onto its KEV catalog (noted in the Tenable update dated October 26) and reporting indicates CISA confirms active exploitation of these flaws.

CHRONOS Bottom Line

Organizations should treat these PHP vulnerabilities as actively exploited and prioritize patching or mitigations now.

Uncertainties / Known Unknowns

Scope and scale of successful compromises are not publicly enumerated in the cited sources; vendor-specific telemetry and exploit details are not included in the provided excerpts.

Detailed Analysis

Tenable recorded that CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on October 26. Independent reporting states CISA confirms these PHP vulnerabilities are being exploited in attacks. CISA's bulletin urges immediate patching. The public KEV addition and confirmation of active exploitation together support treating these flaws as high priority for mitigation.

Sources / Evidence

  1. 01
    php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ
    Tenable2026-10-26
  2. 02
    CISA confirms PHP2Shell vulnerabilities now exploited in attacks
    BleepingComputer2026-10-27
  3. 03
    Critical Vulnerabilities in PHP Require Immediate Patching
    U.S. CISA (GovDelivery bulletin)2026-10-21

Follow CHRONOS ALERTS

Published alerts also appear on Instagram and Threads as @chronosalerts.

Instagram@chronosalertsThreads@chronosalerts