PHP2Shell follow-up: CISA adds both CVEs to KEV; federal patch deadline is 29 Oct
On 26 Oct 2026 CISA added CVE-2026-109618 and CVE-2026-109619 (php2shell) to the Known Exploited Vulnerabilities Catalog with a 29 Oct due date for FCEB agencies. Honeypot evidence from 24 Oct showed working shells on unpatched PHP 8.4.26 under Apache mod_php.
