CISA added two PHP2Shell vulnerabilities to the Known Exploited Vulnerabilities catalog on October 26: CVE-2026-109618 and CVE-2026-109619. Both carry a CVSSv4 score of 9.2 and are attributed to DPRK-affiliated threat actors. Federal Civilian Executive Branch agencies must remediate by October 29, a three-day deadline that reflects active exploitation in the wild.
What PHP2Shell is
PHP2Shell is a web shell delivery framework rather than a single exploit. It provides a modular loader that drops persistent PHP web shells onto compromised servers by chaining two vulnerabilities: an authentication bypass (CVE-2026-109618) that allows unauthenticated file upload, and a path traversal (CVE-2026-109619) that moves the uploaded file outside the intended upload directory and into a web-accessible location. The two-stage chain means that patching only one CVE does not fully remediate the risk.
DPRK attribution and targeting scope
CISA attributes active exploitation to DPRK-affiliated actors, consistent with the pattern of North Korean operators targeting government and critical infrastructure to establish long-term persistence. Web shell access of this type supports intelligence collection and is often left dormant for months before activation. Private sector organizations running internet-facing PHP applications, particularly those in defense, energy, and financial services, should treat this as high urgency regardless of federal agency mandates.
Patch guidance
Identify all internet-facing PHP applications in your environment and confirm vendor patch availability. FCEB agencies must remediate by October 29. Non-federal organizations should target the same window given active exploitation. After patching, scan web roots for unexpected .php files and review server access logs for POST requests to upload endpoints that preceded the patch date, as successful exploitation may have occurred before the vulnerability was disclosed publicly.
Gigia Tsiklauri is the founder of infosec.ge. Get in touch to report a vulnerability, submit a tip, or ask about coverage.