CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The US Cybersecurity and Infrastructure Security Agency CISA on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities KEV catalog The PHP vulnerabilities both rated 92 on the CVSS scoring system facilitate unauthenticated remote code execution on affected deployments CVE2026109618 An outofmemory