US cyber agency confirms attacks on PHP2Shell flaws and sets a patch deadline
CISA added both PHP2Shell flaws to its list of exploited vulnerabilities. Attacks began days before the patches, so unpatched PHP servers are at risk now.
Listen in today's News Flash from 0:17
Update to: PHP patches two critical remote code execution flaws in all supported lines
The two critical PHP flaws fixed on 21 October are now used in real attacks. The US Cybersecurity and Infrastructure Security Agency, CISA, added both to its catalogue of known exploited vulnerabilities on 26 October. Federal agencies had until 30 October to patch. The flaws let an attacker run code on a web server without logging in.
Researchers say attempts started about four days before the patches were out. Working remote shells were later seen on test servers set up to catch attackers. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any server still on an older build of those lines should be treated as exposed. PHP 8.1 and older get no official fix.
Sources
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks — BleepingComputer, 27 Oct 2026 (primary source)
- CISA confirms attackers are exploiting both PHP2Shell flaws — The Next Web, 27 Oct 2026