CISA added CVE-2026-109618 and CVE-2026-109619, the PHP2Shell vulnerabilities, to its Known Exploited Vulnerabilities (KEV) Catalog on October 26, 2026. Its alert calls on organizations to inventory PHP across their systems, prioritize internet-facing services, and monitor for suspicious activity by PHP workers. The PHP project had published fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; NeoTeo’s earlier coverage details those releases.
What CISA’s KEV listing means for PHP operators
The KEV Catalog lists vulnerabilities CISA identifies as known to be exploited. CISA added both PHP2Shell flaws on October 26. Its alert had also been updated on October 23 to include a Sigma detection rule, a rule format used to describe security-event patterns.
Wiz reported that its own captured attempts did not complete an end-to-end exploit chain. Separately, Wiz cited public evidence of successful execution on a honeypot running Apache mod_php with a single worker. That result concerns a specific setup, not every PHP deployment.
Inventory PHP, including embedded installations
CISA recommends taking inventory of PHP throughout an organization, including instances embedded in other software, then prioritizing internet-facing systems. The PHP project identifies PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed installations serving web requests as affected.
If a system cannot be updated immediately, or runs unsupported PHP 8.1 or earlier, CISA recommends taking it offline. The PHP project no longer provides updates for PHP 8.1 and older. It published minimal source backports for PHP 7.4, 8.0, and 8.1; a distribution or long-term-support vendor may provide its own packages. Administrators should use the fixed release or vendor package that applies to the runtime serving their requests. The PHP security advisory lists the fixes and affected configurations.
CISA also recommends watching for PHP workers launching shells or downloading tools. A patch addresses the vulnerable runtime, but does not determine whether an earlier intrusion occurred. A web application firewall (WAF) may provide some protection while an update is pending; the PHP project says interim measures reduce exposure to specific paths but do not make an installation safe.
What Wiz’s exposure metrics count
Wiz reported declines in three different measures after the vulnerabilities became public. Each describes its observed telemetry, not a global census.
| Wiz measure | Reported change | Population and time basis |
| Daily count of distinct internet-exposed vulnerable machines | About 67% lower | Machines observed in Wiz telemetry after public disclosure |
| Organizations with at least one exposed vulnerable instance | About 47.9% lower | Organizations observed by Wiz |
| Share of observed vulnerable, exposed machines running PHP 7.3 or earlier | From 8.3% to 5.7% | Five days |
Wiz says scan coverage and changes in the observed population can affect these trends. Its data do not separate the effects of patching, upgrades, retiring machines, or restricting internet access, so the declines do not show how much any one response contributed.
