{"id":382207,"date":"2026-10-27T03:48:00","date_gmt":"2026-10-27T10:48:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=382207"},"modified":"2026-10-27T03:48:08","modified_gmt":"2026-10-27T10:48:08","slug":"cisa-warns-of-active-php2shell-attacks-patch-vulnerable-php-servers-now","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/cisa-warns-of-active-php2shell-attacks-patch-vulnerable-php-servers-now\/","title":{"rendered":"CISA warns of active PHP2Shell attacks: patch vulnerable PHP servers now"},"content":{"rendered":"

On October 26, the US Cybersecurity and Infrastructure Security Agency, CISA, added PHP<\/a>2Shell<\/strong> , tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. That confirms active abuse in the wild, and it gives US federal civilian agencies until October 29 to remediate. These are PHP core memory-safety bugs with a reported CVSS score of 9.2. They can allow unauthenticated remote code execution, affect PHP 5.4 through 8.5, and leave even well-maintained sites exposed.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"PHP\"\r\n <\/div>\r\n
\r\n PHP<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

By web usage estimates, PHP still powers 69% to 70%<\/strong> of sites that use a server-side language, and Censys counted 32.51 million affected services. The activity showed up fast. Researchers reported remote code execution on honeypots on October 24. Amazon Threat Intelligence saw exploitation attempts as early as October 17, before patches were available. Cloudflare later logged millions of attempts. Check Point said 10% of organizations worldwide were impacted, along with 14% in Europe. Researchers also said some of the attacks dropped the Potassium Mirai variant.<\/p>\n\n

If you’re running Apache HTTP Server<\/a> with mod_php, patch this now<\/strong>. One unauthenticated request can trigger exploitation before your app even gets a chance to run, though reliability depends on worker count, build options, and the environment around it. PHP has published fixed releases for 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches are still vulnerable. On Windows<\/a>, -1 builds fix the Brotli issue tracked as CVE-2026-111497. CVE-2026-115560 appears to be tied to a less common setup. Siemens, Schneider Electric, ABB, and multiple agencies have also published advisories.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Nmap\"\r\n <\/div>\r\n
\r\n Nmap<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"

On October 26, the US Cybersecurity and Infrastructure Security Agency, CISA, added PHP2Shell , tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. That confirms active abuse in the wild, and it gives US federal civilian agencies until October 29 to remediate. These are PHP core memory-safety bugs with a reported CVSS score … Continue reading “CISA warns of active PHP2Shell attacks: patch vulnerable PHP servers now”<\/span><\/a><\/p>\n","protected":false},"author":9349,"featured_media":382206,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-382207","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t