CISA Confirms PHP2Shell Exploits in Attacks

CISA added two critical PHP vulnerabilities tracked as PHP2Shell to its catalog on Monday, ordering federal agencies to patch by Thursday. Threat actors exploited CVE-2026-109618 and CVE-2026-109619 for remote code execution. Roughly 70% of websites use PHP, with 5.1 million hosts exposed. Researchers confirmed in-the-wild exploitation over the weekend.