CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Summary: CISA added two PHP2Shell flaws, both rated 9.2 on CVSS and enabling unauthenticated remote code execution, to its Known Exploited Vulnerabilities catalog on Monday after Perplexity's Adel Karimi confirmed successful RCE against honeypot systems on October 24, 2026. The flaws were patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 released October 21, 2026, with federal agencies given until October 29, 2026, to apply fixes.
What you should know: Censys estimates more than 32.51 million PHP services still run an affected version, and PHP underpins roughly 70% of websites - so the window between confirmed exploitation and the October 29 federal deadline is the exposure your own estate is measured against.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-111497
- Related
- Siemens Industrial Edge Management Cyber Risks · Nov 12, 2026Siemens Desigo, Gridscale Cyber Risks · Nov 12, 2026Node2Shell (CVE-2026-111497) in active exploitation Cyber Risks · Oct 28, 2026