{"id":3802,"date":"2026-10-27T06:27:41","date_gmt":"2026-10-27T06:27:41","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3802"},"modified":"2026-10-27T06:27:41","modified_gmt":"2026-10-27T06:27:41","slug":"cisa-confirms-active-exploitation-of-two-php2shell-flaws-enabling-remote-code-execution","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3802","title":{"rendered":"CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 27, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg-vxKiggBxnuXu0fenkg0gfce0iuuA3OxeVzvWAdc0zaDPDayQgY8y_miqnvHJrpYvw61AhvGHEOW4EIKIYZ4QkRGjGEhqiU-3R0o6m0fgHJYDtszsoXyqse7WDGMh4rvEuTf1T-17KOVkyJKgEcaw5yBXFi6ElwIFyU9TjudvJrHz4fz6VNro8bjUZcnD\/s1700-nu-rw-lo-l85-e365\/cisa-php.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/26\/cisa-adds-two-known-exploited-vulnerabilities-catalog\" target=\"_blank\">confirmed<\/a> active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (<a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\">KEV<\/a>) catalog.<\/p>\n<p>The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments &#8211;<\/p>\n<ul>\n<li><strong>CVE-2026-109618<\/strong> &#8211; An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.<\/li>\n<li><strong>CVE-2026-109619<\/strong> &#8211; A stale internal request-state vulnerability that allows for unauthenticated remote code execution.<\/li>\n<\/ul>\n<p>The addition of the two flaws to the KEV catalog comes after Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution against honeypot systems on October 24, 2026.<\/p>\n<p>\u00abThis is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,\u00bb Karimi <a href=\"https:\/\/x.com\/0x4D31\/status\/2114027420084752479\" target=\"_blank\">said<\/a>. \u00abThe response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit&#8217;s offsets appears in the subsequent execution payload.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-agent-methods-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh-69Sxi6ukfnlM_EpqEB_hRVymcXAcWTNAJetA9huKutPZuG0OOBUvByDCtP_HokC-gM-AzjX0ZhgneUFVzjCyIduRINFj6Yf0JXRFE17_z82UioyT9eoxH2-XQDoD_hInCxc8V2bQrmtnMN-GUR63bseKn7pLRISqlvUJlfuJq8pgCL-Fot7sQDas9D05\/s728-nu-rw-lo-l85-e365\/nudge-3-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abThe evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications.\u00bb<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>The issues have been addressed in <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\">PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35<\/a> released on October 21, 2026. Federal agencies have time until October 29, 2026, to apply the necessary fixes.<\/p>\n<p>PHP, short for PHP: Hypertext Preprocessor, is a server-side scripting language used in <a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" target=\"_blank\">roughly 70% of all websites<\/a> on the internet. According to estimates shared by Censys, more than <a href=\"https:\/\/php2shell.censys.com\/\" target=\"_blank\">32.51 million PHP services<\/a> are still running an affected version.<\/p>\n<p>The severity of the vulnerabilities has prompted numerous advisories from software and security vendors and government agencies across the world, including &#8211;<\/p>\n<p>As of October 26, 2026, the PHP Foundation also released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address <a href=\"https:\/\/broccoli2shell.com\/\" target=\"_blank\">CVE-2026-111497<\/a>, an out-of-bounds write vulnerability in the Brotli decoder library that could also result in <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-111497\" target=\"_blank\">privilege escalation<\/a> and unauthenticated remote code execution.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The vulnerability, also known as Broccoli2Shell, HTTP2Shell, and Node2Shell, affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. It has been patched in versions 1.0.10, 1.1.1, and 1.2.1, along with <a href=\"https:\/\/devblogs.microsoft.com\/dotnet\/dotnet-october-2026-oob-security-updates\/\" target=\"_blank\">other projects<\/a> that include the C library, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.<\/p>\n<p>\u00abIn PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled,\u00bb the PHP Foundation <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-26-1\" target=\"_blank\">said<\/a>. \u00abThis is disabled by default in cURL, but applications and HTTP client libraries can enable it.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 27, 2026Vulnerability \/ Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3803,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[64,62,10,63,524,13,65,11,3875,12],"class_list":["post-3802","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-active","tag-cisa","tag-code","tag-confirms","tag-enabling","tag-execution","tag-exploitation","tag-flaws","tag-php2shell","tag-remote"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3802","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3802"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3802\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3803"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3802"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3802"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3802"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}