CISA KEV catalog addition October 26, 2026; catalog version 2026.10.26, checked October 27, 2026
PHP2Shell Is Now in the CISA KEV Catalog: Federal Deadline Is October 29
CISA added both PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26 and set a remediation due date of October 29, 2026 for federal civilian agencies. The catalog entry requires agencies to apply mitigations in line with vendor instructions under Binding Operational Directive 26-04, to follow forensic triage requirements, and to discontinue use of the product if mitigations are unavailable, and it flags both flaws for forensic triage while listing known ransomware campaign use as unknown. The listing changes the status recorded in yesterday's report: CISA's PHP alert no longer carries its October 21 line that CISA had not observed exploitation. Rescana, summarizing the catalog and SecurityWeek reporting, notes that on October 24 a researcher's honeypots running PHP 8.4.26 under Apache mod_php recorded attackers running shell commands in activity the researcher called consistent with exploitation of CVE-2026-109618, with no second-stage payload download observed. The fixed versions remain PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21.
Executives
A three-day federal deadline is the signal. CISA does not set a clock that short for theoretical risk, and the catalog entry now treats these flaws as exploited, not merely exploitable. Any internet-facing PHP system still unpatched after October 29 is running past the date the federal government gave its own agencies.
CIO / CISO
Work to the federal date even if it does not legally bind you: patch to a fixed version, restart PHP workers so the fixed build actually serves traffic, and complete the forensic triage the catalog flags, hunting from October 17 onward for PHP processes launching shells, new files in web roots, and memory disclosure indicators for CVE-2026-109619. Document any system you take offline instead, because the catalog names discontinuation as the fallback.
Engineers
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or your distribution backport, then restart Apache, LiteSpeed, or PHP-FPM and verify the running version, not just the installed package. Prioritize mod_php deployments, where complete remote code execution was validated, and check long-running workers that may still hold stale request state.
Everyone (non-IT)
If you run a WordPress, Drupal, or Joomla site, ask your host today whether your PHP version was updated this week and whether the service was restarted afterward. A patch that was installed but never loaded does not protect the site.