Critical

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The Hacker News

October 27, 2026 at 4:37 AM

Actively Exploited

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two recently patched vulnerabilities in PHP2Shell are being actively exploited by attackers. Both vulnerabilities are rated 9.2 on the Common Vulnerability Scoring System (CVSS) and allow unauthenticated remote code execution on affected systems. This means that attackers can potentially execute harmful code without needing to authenticate themselves. Organizations using PHP2Shell should be particularly vigilant, as the flaws could lead to severe security breaches if not addressed promptly. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling the urgency for affected users to take immediate action to secure their systems.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: PHP2Shell deployments vulnerable to CVE-2026-109618.
Action Required: Organizations should apply the latest patches provided for PHP2Shell to eliminate these vulnerabilities.
Timeline: Newly disclosed

Original Article Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory

Impact

PHP2Shell deployments vulnerable to CVE-2026-109618.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should apply the latest patches provided for PHP2Shell to eliminate these vulnerabilities. Regularly updating software and monitoring for unusual activity are also recommended mitigation strategies.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability.

Read Original Article

Related Coverage

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

SecurityWeek

The University of New Mexico Health System faced a significant cybersecurity incident that led to the diversion of patients from its main hospital in Albuquerque and the cancellation of appointments at over 30 clinics. The hospital advised people not to come to the facility amid concerns about the security breach. This disruption affects not only the hospital's operations but also puts strain on patients who rely on these services for urgent care. The incident raises questions about the hospital's cybersecurity measures and the potential risks to patient data and safety during such a crisis.

Oct 27, 2026

University of Copenhagen data breach exposes data of 525,000 people

BleepingComputer

The University of Copenhagen has reported a data breach involving unauthorized access to a test environment that contained personal information of approximately 525,000 individuals. This breach has raised concerns as it includes sensitive data that could be exploited by malicious actors. The university has not disclosed specific details on how the breach occurred but emphasized the importance of protecting personal data. Affected individuals may face risks related to identity theft and privacy violations. This incident highlights the need for educational institutions to strengthen their cybersecurity measures to prevent similar breaches in the future.

Oct 26, 2026

Former pentester used ARTEX AI to steal 8.2 million data records

BleepingComputer

South Korean police have arrested seven individuals connected to a significant cybercrime operation that compromised over 90 organizations across the country. The attackers utilized a pentesting framework known as ARTEX AI to exploit vulnerabilities in these organizations' systems. The breach resulted in the theft of approximately 8.2 million data records, raising serious concerns about data security and privacy. This incident not only affects the organizations involved but also poses a risk to individuals whose data may have been exposed. Authorities are now investigating the full extent of the breach and its implications for cybersecurity in South Korea.

Oct 26, 2026

In-the-Wild Attack Abuses AI Agents' Trust in Markdown

darkreading

Researchers have discovered a new technique that allows attackers to exploit AI agents through prompt injection. This method takes advantage of how coding assistants interpret local instruction files, creating confusion between regular text documents and actionable commands. As a result, attackers can manipulate AI behavior, potentially leading to unauthorized actions or data leaks. This issue raises concerns for developers and users who rely on AI tools for coding assistance, as it could compromise the integrity of their work. It's essential for companies to be aware of this vulnerability and take steps to safeguard their AI systems against such manipulations.

Oct 26, 2026

Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI

SecurityWeek

Anthropic, an artificial intelligence company, has recently filed for what could be the largest initial public offering (IPO) in history. Amid this major financial move, CEO Dario Amodei has raised alarms about the potential dangers posed by AI technology, particularly the risk of rogue AI agents executing harmful tasks without human oversight. This concern is especially relevant as there have been reports of hacking incidents involving these AI agents, which further fuels fears about the technology operating beyond our control. The implications of these developments are significant, as they could affect various sectors relying on AI, emphasizing the need for careful regulation and oversight of AI systems to prevent possible disasters.

Oct 26, 2026

DreamHost forces password resets in ongoing "incident"

BleepingComputer

DreamHost has implemented mandatory password resets for its email and FTP/SFTP users due to an incident that caused disruptions to the File Manager interface. This action is likely a precautionary measure to protect user accounts from potential unauthorized access following the incident. Users are advised to change their passwords to ensure the security of their accounts. While the specific details of the incident have not been disclosed, the forced resets indicate that the company is taking steps to mitigate any risks arising from the situation. This incident serves as a reminder for users to maintain strong, unique passwords and to be vigilant about their account security.

Oct 26, 2026