The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert confirming the active exploitation of two critical PHP vulnerabilities. These flaws, recently patched, have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, underscoring their significance in cybersecurity.
Details of the PHP Vulnerabilities
The vulnerabilities in question, identified as CVE-2026-109618 and CVE-2026-109619, have been assigned a severity score of 9.2 on the CVSS scale. Both flaws allow for remote code execution without authentication, significantly impacting affected systems. CVE-2026-109618 involves memory corruption, while CVE-2026-109619 deals with a stale request-state issue.
Adel Karimi from Perplexity confirmed successful exploitation instances, demonstrating remote code execution capabilities against specially set up honeypot systems on October 24, 2026. Karimi noted, “The evidence indicates this execution chain is effective on the single-worker mod_php setup,” though it may not reflect reliability across different PHP configurations.
Impact and Mitigation Measures
PHP, a widely-used server-side scripting language, powers approximately 70% of websites globally. With over 32.51 million PHP services potentially affected, the urgency to address these vulnerabilities is palpable. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released to mitigate these risks, with federal agencies given a deadline of October 29, 2026, to implement the necessary updates.
The vulnerabilities’ critical nature has prompted worldwide advisories from various security organizations and software vendors. These advisories aim to guide affected users and organizations in applying the requisite patches and safeguard measures.
Additional Security Concerns
In addition to the PHP vulnerabilities, the PHP Foundation has addressed another critical security issue: an out-of-bounds write vulnerability in the Brotli decoder library, known as CVE-2026-111497. This flaw, referred to by names such as Broccoli2Shell, HTTP2Shell, and Node2Shell, could lead to privilege escalation and unauthenticated remote code execution.
Security patches for this vulnerability have been implemented in Brotli versions 1.0.10, 1.1.1, and 1.2.1, affecting numerous projects including Node.js and Python. The PHP Foundation notes that in PHP Windows builds, the vulnerable decoder is accessible via the cURL extension, although this is typically disabled by default.
This spate of vulnerabilities highlights the ongoing challenges in maintaining secure web environments, emphasizing the need for timely updates and vigilant cybersecurity practices.
