Subscribe

Cybersecurity · AltTab Dad

PHP2Shell follow-up: CISA adds both CVEs to KEV; federal patch deadline is 29 Oct

Quotable summary

Five days after PHP’s emergency releases, CISA added both php2shell CVEs to its Known Exploited Vulnerabilities (KEV) Catalog on 26 October 2026. The catalog entries list a due date of 29 October 2026 for Federal Civilian Executive Branch (FCEB) agencies under BOD 26-04, including forensic-triage expectations. The same day CISA updated its 21 October PHP alert. Separately, researcher Adel Karimi (Perplexity) published honeypot evidence from 24 October of 35 working shells spawned by Apache workers on unpatched PHP 8.4.26 (mod_php). That is stronger than the early-week scan-and-crash reports. Translation: if you still have web PHP behind last week’s builds, treat the federal deadline as a public urgency signal — patch, then look back for compromise.

What changed since our 25 Oct digest

Item Detail
KEV add CVE-2026-109618 (PHP Memory Corruption) and CVE-2026-109619 (PHP Stale Internal Request-State) added 26 Oct 2026 (CISA KEV alert; confirmed in CISA KEV JSON feed)
Federal due date 2026-10-29 (KEV dueDate for both CVEs)
BOD BOD 26-04 — prioritize KEV on publicly exposed assets that grant total control post-exploitation; check for pre-patch compromise where required
CISA PHP alert Updated 26 Oct to reflect the KEV listing (Critical Vulnerabilities in PHP Require Immediate Patching)
Fixed versions (unchanged) 8.5.12, 8.4.27, 8.3.36, 8.2.35
Ransomware use (KEV field) Unknown for both CVEs

Working shells on honeypots (not a mass-breach scoreboard)

On 24 October 2026, Karimi’s decoys running PHP 8.4.26 under Apache mod_php recorded 35 cases where an Apache worker spawned /bin/sh after a four-request multipart chain (memory pressure → disclosure cookie → another OOM → execution). Coverage in SecurityWeek and BleepingComputer treats this as confirmed RCE on that profile. Karimi cautions it is not a reliability measure across other worker counts, PHP builds, or apps. CISA’s KEV listing does not publish victim names; “working shells on research honeypots” is not the same as a confirmed production-breach census.

Monday checklist (ops)

  1. Inventory every host and image that serves HTTP through PHP (including bundled PHP in appliances/panels — CISA notes inventory-by-“we installed PHP” misses some).
  2. Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart Apache / PHP-FPM / equivalent.
  3. If you cannot patch, or still run PHP 8.1 or older, CISA says take PHP-based systems offline until fixed.
  4. Hunt after (or before) patch: PHP workers launching shells, oversized/session-memory oddities, sudden worker crashes, unexpected outbound from web users. Prefer collecting volatile evidence before a restart wipes it when compromise is plausible.
  5. WAF rules remain mitigation, not a substitute for the upgrade.

Sources