The PHP2Shell affair, which has rattled the cybersecurity world for a week, has escalated. The US Cybersecurity and Infrastructure Security Agency (CISA) added the two critical vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619, to its catalog of vulnerabilities exploited in real attacks (KEV). In other words, as far as the US agency is concerned, this is no longer a theoretical danger.
A very short deadline
According to reports, CISA added the flaws to the catalog on October 26 and gave federal civilian agencies until October 29, tomorrow, to fix them. The directive requires fixing internet-facing servers first, and also checking whether they were compromised before or during the update. In an updated alert, the agency told organizations that cannot update immediately, or that run versions no longer supported, to take their PHP-based systems offline until they are patched.
What is known about the attacks
According to published data, the first exploitation attempts were detected even before the flaws were officially disclosed on October 21. Security firm watchTowr reported active exploitation from that day, and a security researcher at Perplexity reported that honeypots recorded remote code execution on an Apache server with mod_php running PHP 8.4.26. Reports also include claims of scanning by actors linked to North Korea, but these have not been independently verified.
Updates have been available since October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older, unsupported versions, the PHP security team published minimal source-code fixes. A third flaw, CVE-2026-115560, which is lower risk, still has no patch.
What it means for organizations
The CISA directive binds only the US federal government, but around the world, including in Israel, it serves as a clear signal of priorities. Every organization running PHP, including WordPress sites, online stores and internal systems, should make sure its servers are updated and check server logs for signs of intrusion. Small organizations on shared hosting should ask their provider for explicit confirmation that the update has been installed.
