CISA confirms PHP2Shell exploitation in the wild, adds both CVEs to its KEV catalog with an Oct 29 federal patch deadline

PHP2Shell is the name the security industry gave to the two unauthenticated remote code execution vulnerabilities PHP patched on October 21, 2026 — CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. On October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) put both identifiers into its Known Exploited Vulnerabilities (KEV) catalog: the catalog page lists a dateAdded of 2026-10-26 and a due date of 2026-10-29 for each entry. Five days after the fixes shipped, in-the-wild exploitation went from a set of clashing vendor claims to an official US government determination.

Key points

• The two KEV entries are named PHP Memory Corruption Vulnerability and PHP Stale Internal Request-State Vulnerability; the known ransomware use field reads Unknown, and CISA has not said who is exploiting the bugs.
• Researcher Adel Karimi’s (0x4D31) public honeypot data logs exploitation attempts on October 22 and a confirmed RCE on October 24 — 35 case folders of packet captures plus Apache, PHP and Tetragon runtime records. Wiz calls this evidence a “likely contributing factor” to the KEV listing.
• Wiz’s telemetry shows the daily count of distinct internet-exposed vulnerable machines fell about 67% within days — yet in every captured run from public sources, the memory-leak stage “failed,” and no end-to-end successful exploitation has been observed.

Background

In-the-wild exploitation was the open question hanging over PHP2Shell. Our October 22 entry on PHP patching the two 9.2 RCEs recorded the contradiction as it stood: OpenAI said “there were no reports of exploits in the wild,” watchTowr marked “Exploited in the wild: Yes” on release day, and AWS reported a MadPot honeypot attempt dating to October 17. That entry also noted the KEV catalog (catalogVersion 2026.10.21, 1,754 entries) did not yet list either CVE.

KEV listing has a specific meaning: CISA treats the flaw as confirmed-exploited, and federal civilian agencies must act by the deadline. The official stamp settles the question in watchTowr’s and AWS’s favor.

The deadline

The catalog fields for both entries, as queried on the CISA KEV page (October 28):

CVE	KEV name	Added	Due
CVE-2026-109618	PHP Memory Corruption Vulnerability	2026-10-26	2026-10-29
CVE-2026-109619	PHP Stale Internal Request-State Vulnerability	2026-10-26	2026-10-29

October 29 comes from KEV’s due-date mechanics: the required action is to apply vendor mitigations per CISA’s BOD 26-04 guidance, discontinue use where mitigation is unavailable, and assess each asset’s internet exposure. TechCrunch reported it on October 27 as ordering civilian federal agencies to fix their systems within three days. Be clear about the boundary: the deadline binds US federal civilian agencies and their supply chains, not every PHP site, and CISA released no details about the attackers. The KEV entries themselves carry no score or affected-version range — the CVSS v4.0 9.2 ratings come from php.net’s October 20 pre-announcement and GitHub security advisory GHSA-w8hw-w9fx-j79w (whose 4.0 vector is CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

Honeypots and telemetry

Two kinds of evidence sit under the determination. The hard one: 0x4D31’s honeypot-data repository documents October 22–24 in two observation reports, from initial exploitation attempts to confirmed RCE on the 24th. The evidence folder 2026-10-24-rce-evidence holds 35 case folders with HTTP captures plus Apache, PHP, Tetragon and signal records; source IPs were deliberately left unredacted to serve as indicators.

The other kind argues the opposite direction. Wiz’s own PHP-CGI and Roundcube honeypots caught attempts that all failed. Of two exploit kits hitting its PHP-CGI sensors, the legacy chain died on post_max_size limits, and the newer one (mk_a1.py / mk_leak_b.py) reliably triggered memory exhaustion (HTTP 500) but never once leaked process memory. The failure is environmental: the leak stage was tuned to the official php:8.4.26-apache image with a 128 MB limit, so any different build, extension set or memory limit shifts the heap layout it depends on — and pinning requests to the same worker does not survive internet latency and timeouts. Wiz also saw impostor tools trading on the name, doing session poisoning plus a local file inclusion against lfi_sink.php, an endpoint that exists only in lab setups. Feasibility itself is not in doubt: Wiz privately received working exploits from partners and demonstrated its own at php2shell.com.

What others say

Wiz’s remediation numbers (its own telemetry, with explicit caveats): within days of disclosure, the daily number of distinct exposed vulnerable machines fell about 67%; the share of exposed machines running PHP 7.3 or older dropped from 8.3% to 5.7%; organizations with at least one exposed instance fell about 47.9%; a week after disclosure, fewer than 53% of initially affected organizations remain exposed. Wiz’s conclusion is that remediation remains essential, and it expects the two current barriers — heap-layout sensitivity and worker pinning — to fall as skilled actors adapt the chain.

Unit 42’s retraction is the other footnote. Its threat brief had added an update on October 23, 12:30 p.m. PT, tying the initial access of a European government agency breach to PHP2Shell; on October 25 at 2:15 p.m. PT it retracted that, writing “We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs” and “We have retracted our previous update from October 23.” The retraction landed one day before the KEV addition. The same brief cites Cortex Xpanse telemetry of over 22.6 million potentially vulnerable exposed instances and holds that exploitation is not confirmed — which can coexist with the official determination, because the two statements draw the line differently: CISA accepted honeypot evidence of a confirmed RCE, while Unit 42 has not attributed any real intrusion to these CVEs.

A batch of other claims are TechCrunch’s reporting, not in any primary announcement, so they need the attribution kept: the flaws were found two years ago and the PHP Foundation judged there was no practical way to exploit them, leaving the bugs unpatched; Calif used an AI model to find a path chaining the dormant bugs; and, relaying Reuters, the foundation’s director said it had one full-time staff member.

Our take

The open question is now closed in a specific way: the official position and the honeypot evidence agree, and “no one has landed a full chain on the public internet yet” still holds — both are true at once. For operators the message is that bought time is real but short: a ~67% drop in exposure within days shows patching is feasible at scale, and Wiz expects the current barriers won’t hold long. The first minute is the same routine: run php -v, and on 8.2–8.5 move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35; search the KEV catalog for both CVEs to see whether your product or customers fall under federal supply-chain obligations; on shared hosting, ask your host. October 29 is a pressure line for federal agencies and their suppliers, not a safety boundary for ordinary sites. What remains unknown stays unknown: who the exploiters are, and whether any real intrusion has succeeded outside public view — CISA did not say, and honeypot evidence proves what happened on honeypots. Patch diffs remain attacker reading material, as when probes hit a fix PR within 10 minutes.