While CISA has confirmed exploitation of the critical-severity PHP vulnerabilities, the extent of successful attacks leveraging the flaws remains unclear.
While the U.S. cybersecurity agency has now confirmed exploitation of a pair of critical-severity PHP vulnerabilities, known as PHP2Shell, the extent of successful attacks leveraging the flaws remains unclear.
The evidence that the PHP2Shell vulnerabilities have been successfully exploited has grown stronger in recent days, as suggested by an advisory issued Monday by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
[Related: PHP Threat Is Likely Far From Over, Despite Limited Exploitation So Far: GuidePoint Expert]
But the larger concerns about the potential for mass exploitation of the flaws appear to have not yet been realized, according to researchers that have posted updates on the threat.
The PHP2Shell vulnerabilities—which are considered a “critical” risk with severity ratings of 9.2 out of 10—can enable attackers to execute code remotely without authentication. PHP is a key technology behind numerous web platforms including WordPress and Drupal.
PHP released fixes to address the vulnerabilities, which are tracked as CVE-2026-109618 and CVE-2026-109619. Organizations are being urged to install the appropriate update or obtain patched packages from their software vendor.
Still, the ability to respond quickly to the threat may vary substantially based on the size of the organization, GuidePoint Security’s Justin Timothy told CRN.
“Massive organizations with robust security teams and robust vulnerability management teams—they’re the ones patching immediately. They have the resources to do so,” said Timothy, threat intelligence consultant at Herndon, Va.-based GuidePoint Security, No. 32 on CRN’s 2026 Solution Provider 500. “It’s the small to medium businesses that don’t have that budget for security that are going to be most impacted here.”
What follows are the five latest updates on PHP2Shell exploitation.
CISA Confirms Exploitation
CISA added both PHP2Shell vulnerabilities to its catalog of exploited vulnerabilities Monday, based on evidence of active exploitation.
The agency said it is “unknown” if either of the PHP flaws has been utilized in ransomware campaigns.
Affected agencies will have until Thursday to deploy mitigations for the critical PHP vulnerabilities, CISA ordered.
Honeypots Evidence
A researcher at Perplexity has reported having documented multiple successful shell launches across honeypots over the weekend—which provides evidence that PHP2Shell exploitation can in fact result in remote code execution.
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Perplexity researcher Adel Karimi wrote in a post on X.com on Saturday.
The findings are “by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far,” wrote well-known security researcher Marcus Hutchins, principal threat researcher at Expel, in a post on X.com.
Retraction Of Breach Attribution
An earlier assessment that had linked an intrusion at a European governmental organization to PHP2Shell has been withdrawn, according to Palo Alto Networks’ Unit 42 threat research division.
While an initial assessment from Unit 42 had described the purported activity, an update Sunday suggested that it could not be confirmed that the PHP2Shell vulnerabilities had enabled the initial access.
“Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities,” Unit 42 said in its update.
“What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application. This led us to believe that it was exploitation of those vulnerabilities,” Unit 42 said. “We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.”
The European government agency was not specified by Unit 42.
Cisco Details Affected Products
Cisco has identified several products affected by the PHP2Shell vulnerabilities, while continuing to investigate the potential for exposure to the flaws in other products, according to an advisory updated Monday.
Affected products include Expressway Series, Expressway Select Series, Duo Access Gateway and Ultra-Reliable Wireless Backhaul, according to Cisco. The advisory identifies software versions containing fixes and directs partners and customers to available workarounds.
The company is also investigating Identity Services Engine Portal Builder, Software Defined-Application Visibility and Control, its Cloud Connector and Unified Industrial Wireless Software, Cisco said. Those products have not been confirmed vulnerable. Cisco separately lists its main Identity Services Engine product as unaffected.
Oracle Expands Affected Product List
Oracle added Secure Backup to its list of products affected by PHP2Shell on Monday, expanding an advisory initially released Sunday.
The advisory also lists Oracle Solaris 11 and multiple Oracle Communications products, including Diameter Signaling Router and Unified Assurance.
Oracle urged customers to apply available patches to address the PHP vulnerabilities as quickly as possible.
