On 26 October 2026 CISA added CVE-2026-109618 and CVE-2026-109619 — known together as PHP2Shell — to its Known Exploited Vulnerabilities (KEV) catalog. US federal civilian agencies must fix or disconnect affected systems by 29 October.
Both flaws sit in the PHP engine itself and allow unauthenticated remote code execution, so every application on top — WordPress, Laravel, EC-CUBE, custom code — is exposed until PHP is updated. PHP shipped fixes on 21 October in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 8.1 and older get no official release.
In Japan, JPCERT/CC updated its alert on 26 October: many proof-of-concept exploits claiming to work have been published, and several organisations report traffic attempting to exploit the bugs. A researcher also demonstrated a working exploit against a honeypot on 24 October, in a single-worker Apache mod_php setup — a reminder that mod_php servers are the most exposed.