CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA has added two critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Both vulnerabilities are rated 9.2 on the CVSS scoring system and allow unauthenticated remote code execution on affected deployments. One of the identified flaws is CVE-2026-109618, described as an out-of-memory vulnerability. The flaws were recently patched but are already being actively exploited. CISA's inclusion in the KEV catalog signals urgent action is required by federal agencies and organizations using affected PHP2Shell deployments. The high CVSS scores and unauthenticated nature of the exploit make these vulnerabilities particularly dangerous. Organizations are advised to apply patches immediately to mitigate the risk of compromise.