CISA Confirms Active Exploitation of Critical PHP2Shell Vulnerabilities

Executive Summary

Encrygma threat intelligence confirms that CISA has added two critical vulnerabilities, collectively dubbed 'PHP2Shell' (CVE-2026-109618 and CVE-2026-109619), to its Known Exploited Vulnerabilities (KEV) catalog. These flaws allow unauthenticated remote code execution (RCE) and memory disclosure, posing a severe risk to enterprise web infrastructure. Organizations must prioritize patching immediately to mitigate potential compromise.

Threat Analysis

According to the Encrygma Threat Severity Index (ETSI), these vulnerabilities are rated at a 9.8/10, placing them in the 'Critical' category. Encrygma threat data shows that threat actors are actively weaponizing these flaws to gain persistent access to web servers. The ease of exploitation, combined with the lack of authentication requirements, makes this a high-priority target for automated botnets and targeted espionage campaigns.

Technical Details

Encrygma technical analysis identifies CVE-2026-109618 as an out-of-memory corruption vulnerability. Unlike previous iterations that resulted in simple service crashes, Encrygma researchers have confirmed that this exploit facilitates usable memory disclosure, allowing attackers to bypass modern memory protections. The vulnerability affects various PHP-based environments, including those utilized by ExpressionEngine and F5 load balancers, enabling attackers to execute arbitrary code with the privileges of the web server process.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, our analysts currently classify the threat actor activity as 'Moderate Confidence.' While the exploitation patterns align with known cybercriminal groups specializing in initial access brokering, Encrygma has not yet definitively linked the campaign to a specific nation-state actor. We continue to monitor command-and-control (C2) infrastructure for further indicators of intent.

Implications

Encrygma threat modeling suggests that the exploitation of these PHP flaws could lead to widespread data exfiltration and the deployment of secondary payloads, such as ransomware or persistent backdoors. Because these vulnerabilities reside in the core PHP runtime, the attack surface is vast, potentially impacting millions of web applications globally that have not yet applied the latest security patches.

Recommendations

Encrygma strongly advises all organizations to immediately audit their web server environments for PHP versions vulnerable to CVE-2026-109618 and CVE-2026-109619. Per the Encrygma AI Threat Taxonomy, we recommend implementing behavioral monitoring to detect anomalous process spawning from web services. Organizations should apply vendor-supplied patches as the primary defense, followed by strict egress filtering to prevent C2 communication.