The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday officially confirmed the active exploitation of the recently patched PHP2Shell vulnerabilities, adding the critical flaws to its Known Exploited Vulnerabilities (KEV) catalog. The move underscores the severe and immediate risk that these security gaps pose to web infrastructure worldwide, prompting urgent warnings and tight compliance deadlines for federal agencies and private sector organizations alike.
The vulnerabilities in question affect PHP, the widely utilized server-side scripting language that powers roughly 70 percent of all websites across the internet. Both PHP vulnerabilities carry a critical severity rating of 9.2 out of 10.0 on the Common Vulnerability Scoring System (CVSS), facilitating unauthenticated remote code execution on vulnerable deployments without requiring prior access or valid credentials.
The formal addition of these two flaws to CISA’s KEV catalog follows alarming real-world verifications. Adel Karimi, detection and response lead at Perplexity, confirmed successful instances of remote code execution targeting honeypot systems on October 24, 2026. Karimi’s findings provided definitive proof that attackers were moving beyond mere denial-of-service crashes or suspicious background processes to achieve full system compromise.
"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi stated in a security assessment shared publicly. He noted that the malicious response delivered an 800-kilobyte decoded cookie dump, and a function address derived from that dump using public exploit offsets subsequently appeared in the execution payload. Karimi emphasized that this specific evidence demonstrated the attack chain on an intentionally favorable single-worker mod_php profile, cautioning that it was not a direct measurement of exploit reliability across all other worker counts, custom PHP builds, or complex enterprise applications.
In response to the escalating threat landscape, the PHP development team rolled out emergency patches on October 21, 2026. The issues are fully addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Under CISA’s binding operational directives, U.S. federal civilian executive branch agencies were given a stringent deadline to apply the necessary security fixes by October 29, 2026, to prevent potential state-sponsored or opportunistic cyber intrusions.
Despite the swift release of patches, the sheer ubiquity of PHP means that remediation presents a monumental challenge for system administrators globally. According to telemetry and market estimates shared by internet census firm Censys, more than 32.51 million individual PHP services were still running an affected, vulnerable version shortly after the disclosure. The immense scale of the potential attack surface has triggered a wave of advisories from software vendors, security researchers, and governmental cyber defense agencies around the world, urging immediate scanning and updating of all web-facing assets.
The crisis has been further complicated by a related and equally dangerous vulnerability discovered in the underlying compression libraries frequently utilized alongside modern software stacks. As of October 26, 2026, the PHP Foundation released specialized Windows builds—specifically versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1—to mitigate CVE-2026-111497. This vulnerability is an out-of-bounds write flaw residing in the Brotli decoder library, which can result in severe consequences including privilege escalation and unauthenticated remote code execution.
This broader flaw, which has been colloquially tracked across the cybersecurity community under various names including Broccoli2Shell, HTTP2Shell, and Node2Shell, impacts multiple versions of the Brotli compression library, specifically versions 1.0.3 through 1.0.9, as well as versions 1.1.0 and 1.2.0. The vulnerability has since been patched in versions 1.0.10, 1.1.1, and 1.2.1. Because the vulnerable C library is embedded in a vast array of modern software ecosystems, emergency security updates have also been issued by numerous other major projects, including Node.js, Bun, Envoy Proxy, Istio, .NET, and Python.
Detailing how the vulnerability manifests within the PHP environment on Windows operating systems, the PHP Foundation explained that the vulnerable decoder can be reached directly through the cURL extension when automatic HTTP response decompression is enabled. While this risky feature is disabled by default within standard cURL configurations, many third-party applications and HTTP client libraries explicitly enable it to optimize network performance, inadvertently opening the door to exploitation.
As organizations scramble to inventory their software dependencies, apply patches, and update vulnerable web servers and client libraries, cybersecurity authorities continue to monitor the threat landscape closely. The rapid transition from initial vulnerability disclosure to active exploitation in the wild highlights the persistent urgency for automated patch management and robust perimeter defense strategies across the global digital ecosystem.
