CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
CISA added the widely publicized PHP vulnerabilities to the KEV, but didn’t specify what kind of exploitation it was observing.
The federal cybersecurity agency confirmed that two PHP vulnerabilities are being targeted, and ordered all civilian agencies to patch them by Thursday.
The Cybersecurity and Infrastructure Security Agency (CISA) added the bugs to the Known Exploited Vulnerabilities (KEV) catalog on Monday evening but declined to answer questions about the nature of the exploitation or potential victims. Within the federal government itself, it’s unclear how many systems might use PHP.
The vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — caused global alarm last Tuesday due to the ubiquity of the PHP programming language across the internet. But throughout the week and into the weekend, experts tempered concerns of mass exploitation due to the lack of viable proof-of-concept (PoC) exploits.
A spokesperson for the agency directed Recorded Future News to a section of the KEV rules that said CISA considers “active exploitation” to include both attempted and successful exploitation of vulnerabilities.
Both Sophos and Palo Alto Networks have in recent days posted and then retracted claims of successful exploitation but several experts were able to discover ways to exploit the bugs by Sunday.
In an updated advisory about the vulnerabilities, CISA urged organizations to identify and inventory systems running any version of PHP, apply the patch or take PHP-based systems offline if they cannot be updated immediately.
In some cases, web application firewalls may provide some level of protection for a period of time, CISA added.
The advisory links to guidance from PHP as well as government cybersecurity agencies in Australia, Canada, New Zealand, the U.K. and others.
Despite the lack of confirmed successful exploitation, dozens of cybersecurity and tech companies reported thousands of failed attempts to use the bugs in attacks.
PHP is used to build and run web applications and the vast majority of websites. Some estimates show that more than 70% of all websites on the internet use PHP. Dozens of governments and businesses took their websites offline last week in an effort to address the vulnerabilities.
Experts have expressed deep concern that millions of PHP-backed websites are still running ancient versions of the language that likely cannot be updated.
Censys created a PHP2Shell dashboard that says of the 42 million Internet-facing PHP services, more than 10 million have been patched since October 21.
