CISA Confirms Attackers Are Exploiting Critical PHP Flaws: Patch Now

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of two recently patched PHP flaws, known as PHP2Shell, by adding them to its Known Exploited Vulnerabilities catalog. Both are rated 9.2 on the CVSS severity scale and allow unauthenticated remote code execution, meaning an attacker does not need a login to run code on an affected server.

The listing follows confirmation by Adel Karimi, detection and response lead at Perplexity, of successful remote code execution against honeypot systems on October 24, 2026. Karimi noted the evidence covers a deliberately favourable test setup and does not measure how reliable the attack is on other configurations, PHP builds or applications. Fixes were released on October 21, 2026 in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP is used in roughly 70% of websites, and Censys estimates more than 32.51 million PHP services still run an affected version.

Separately, the PHP Foundation released Windows builds on October 26, 2026 to address CVE-2026-111497, an out-of-bounds write flaw in the Brotli decoder library. It could also lead to privilege escalation and unauthenticated remote code execution. The Brotli flaw is also called Broccoli2Shell, HTTP2Shell and Node2Shell, and is patched in Brotli 1.0.10, 1.1.1 and 1.2.1, as well as in other projects that include the library, such as Node.js, Bun, Envoy Proxy, Istio, .NET and Python.