CISA confirms attackers are exploiting both PHP2Shell flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has put both PHP2Shell flaws in its Known Exploited Vulnerabilities catalogue. It made the change on Monday, according to its alert. Federal civilian agencies have until Thursday, 29 October, to fix CVE-2026-109618 and CVE-2026-109619.