CISA confirms attackers are exploiting both PHP2Shell flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has put both PHP2Shell flaws in its Known Exploited Vulnerabilities catalogue. It made the change on Monday, according to its alert. Federal civilian agencies have until Thursday, 29 October, to fix CVE-2026-109618 and CVE-2026-109619…
Sources
Vulnerabilities
Why this score
| Signal | Points |
|---|---|
| kev added | 50 |
| kev short fuse — 3 days to remediate | 15 |
| ssvc active | 35 |
| cvss critical — 9.2 | 20 |
| epss high | 20 |
| public poc — 709 repositories | 20 |