CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Summary
CISA has confirmed the active exploitation of two PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities catalog. These vulnerabilities, rated 9.2 CVSS, allow for unauthenticated remote code execution on affected systems.
IFF Assessment
The confirmed active exploitation of critical vulnerabilities allowing remote code execution represents a significant threat to defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 29, 2026. Known ransomware use: Unknown.
Defender Context
Defenders need to prioritize patching and validating the security of PHP deployments due to the active exploitation of these critical vulnerabilities. The inclusion in CISA's KEV catalog signifies a real-world threat that requires immediate attention.