The US cyber security agency CISA on 26 October added the two critical PHP vulnerabilities known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalogue. Inclusion means there is confirmed evidence of active exploitation, and US federal agencies must fix them as a priority. CISA also updated its alert urging immediate patching. The flaws are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What it means: Inclusion in the CISA catalogue is one of the most reliable signals that a vulnerability is no longer theoretical but is being used in real attacks. For PHP this matters a great deal, because a large share of websites rely on it, from WordPress and online shops to internal business applications. Many Greek businesses host their sites on shared servers, where the PHP version is set by the hosting provider rather than by them. The practical step is to check in the hosting control panel which version is running, ask the provider to confirm it has applied the fixed releases, and upgrade any sites still on old, unsupported versions. Where patching was late, a check for signs of compromise is also needed, such as unknown files, new admin accounts or suspicious code changes. For organisations covered by the NIS2 directive and Greek law 5160/2024, documented vulnerability management is an obligation, and a known flaw left unpatched is hard to justify after an incident.

Read the original on CISA

Related service: Custom software

Related stories