CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

Live updates

1. 2h ago

   CISA Confirms Active Exploitation of PHP2Shell Flaws

   The U.S. Cybersecurity and Infrastructure Security Agency added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active attacks in the wild. Both PHP vulnerabilities carry a CVSS score of 9.2 and enable unauthenticated remote code execution on vulnerable deployments. Federal agencies face an official government deadline to apply patches and secure their systems. Security researchers describe the threat as an urgent security crisis driven by rapid exploitation attempts following the disclosure of the web bugs.

   Why it matters

   The active exploitation highlights systemic risks in widespread web technologies and demonstrates how quickly newly discovered flaws can operationalize into real-world attacks. Organizations across industries are racing to audit environments and deploy mitigations. Government advisory bodies stress that timely vulnerability management remains critical to prevent unauthorized system access.

   What is confirmed

   • The U.S. Cybersecurity and Infrastructure Security Agency added two PHP2Shell vulnerabilities to its catalog of actively exploited security flaws.
   • Both PHP vulnerabilities are rated 9.2 on the CVSS scoring system and enable unauthenticated remote code execution on affected deployments.
   • Federal agencies have been ordered by CISA to patch their systems by Thursday.
   • Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.

   What to watch next

   • Federal agency compliance reports following the Thursday patch deadline
   • Additional telemetry on the scale and scope of PHP2Shell exploitation attempts across enterprise networks
   Sources used for this update (19)

   1. OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities
   2. National Security Agency (.gov) — NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
   3. CNN — The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days
   4. The Atlantic — The Safe Internet Is Shrinking
   5. The New York Times — The 5 Things You Need to Know About the PHP Security Flaw Breaking the Internet
   6. CNN — AI is exposing how fragile the web really is. What you can do to stay safe
   7. The Hacker News — CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
   8. www.bleepingcomputer.com — CISA confirms PHP2Shell vulnerabilities now exploited in attacks
   9. TechCrunch — US government says hackers are now exploiting critical PHP web bugs
   10. SOC Prime — CVE-2026-115560: Unpatched PHP RCE Vulnerability
   11. wiz.io — PHP2Shell: Exploitation Attempts and Remediation Trends
   12. Cloudflare Blog — Introducing the Cloudflare PHP Capture the Flag challenge
   confidence 100%