Trusence Every claim has a source
Last updated 27 October 2026 Search Türkçe
Security

CISA Flags Two Exploited PHP Flaws Allowing Unauthenticated Code Execution

With more than 32.51 million PHP services still running an affected version, unpatched servers remain open to remote attack.

27 October 2026 1 min read

CISA has added two recently patched PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog after honeypot tests confirmed remote code execution. Both are rated 9.2 on CVSS and allow unauthenticated attackers to run code on affected deployments. The fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026, and U.S. federal agencies have until October 29, 2026 to apply them. The PHP Foundation also shipped Windows builds to address a separate Brotli decoder flaw, CVE-2026-111497, which can be reached through cURL when automatic response decompression is enabled. Censys estimates more than 32.51 million PHP services still run an affected version.

Why it matters

The two flaws are confirmed as actively exploited and can be triggered without authentication, which puts any internet-facing PHP deployment that has not yet moved to a fixed release at direct risk of remote code execution. U.S. federal agencies face a hard deadline of October 29, 2026 to apply the fixes, and the Censys estimate suggests a large share of PHP services worldwide may still be exposed. A separate Brotli decoder flaw, reachable through cURL when automatic response decompression is enabled, means Windows users need the new builds as well.

Series Critical PHP flaws

  1. 27 Oct CISA Flags Two Exploited PHP Flaws Allowing Unauthenticated Code Execution
  2. 26 Oct Critical PHP flaws prompt urgent patching across a large share of the web
  3. 26 Oct Industrial Vendors Assess Exposure to PHP2Shell Flaws in Their Products
  4. 26 Oct Two PHP flaws patched after first confirmed in-the-wild attacks
  5. 25 Oct PHP2Shell flaws used in fast attack on European government, with wider scanning under way
  6. 25 Oct PHP Emergency Fixes Close Two Critical Remote Code Execution Flaws Already Under Attack
The whole series · 17 stories →

Sources · 1

Checked against its sources before publishing · 27 October at 09:08