CISA Adds Two PHP2Shell RCE Flaws to KEV Catalog

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that two recently patched PHP2Shell vulnerabilities are being actively exploited in the wild. By adding the flaws to its Known Exploited Vulnerabilities (KEV) catalog, CISA signals that threat actors are already leveraging them to achieve unauthenticated remote code execution on vulnerable deployments.

What the KEV Addition Means

The KEV catalog is a curated list of vulnerabilities that have confirmed exploitation activity. Inclusion triggers mandatory remediation timelines for federal agencies and serves as a strong advisory for private‑sector organizations. When a flaw appears on this list, defenders should treat it as a high‑priority incident rather than a routine patch cycle.

Technical Details of the Flaws

Both vulnerabilities carry a CVSS v3.1 base score of 9.2, placing them in the critical severity band. The first identifier, CVE-2026-109618, is described as an out‑of‑memory condition that can be triggered without authentication, allowing an attacker to execute arbitrary code on the host. The second vulnerability has not yet been publicly assigned a CVE identifier or detailed description; CISA’s advisory notes only that it shares the same exploitation vector and severity rating. Because full technical write‑ups are still pending, security teams should assume the worst‑case impact until vendors release complete advisories.

Impact and Affected Deployments

PHP2Shell is a lightweight web‑shell framework used in a variety of custom applications, legacy content management systems, and internal tooling. Any server that runs the vulnerable PHP2Shell codebase — regardless of operating system — is at risk. Since the exploitation requires no credentials, internet‑facing web servers, development environments, and poorly segmented internal hosts are all viable targets. Organizations that have not inventoried their PHP2Shell usage may have hidden exposure.

Recommended Mitigation Steps

• Apply vendor patches immediately. The PHP2Shell maintainers have released fixes for both issues; deploy them on all affected instances.
• Validate patch deployment. Use automated configuration‑management tools or vulnerability scanners to confirm that the patched versions are running.
• Implement network segmentation. Restrict inbound traffic to only required services and isolate legacy PHP applications from critical assets.
• Enable runtime monitoring. Deploy web‑application firewalls (WAF) and endpoint detection and response (EDR) sensors to flag anomalous code execution patterns.
• Conduct threat hunting. Search logs for indicators of compromise associated with PHP2Shell exploitation, such as unexpected process spawns or outbound connections from the web server user.
• Update inventory and risk registers. Record the presence of PHP2Shell components, their patch status, and the associated risk rating.

Conclusion

CISA’s confirmation of active exploitation for the two PHP2Shell remote code execution flaws raises the stakes for any team running this framework. Immediate patching, rigorous verification, and layered defenses are essential to prevent compromise. By integrating real‑time KEV intelligence into automated DevSecOps workflows — such as those offered by Grivyonx — security teams can close the exposure window faster and maintain continuous compliance.