PHP2Shell is on KEV. Thursday is the clock. The worker is the asset.

CISA added CVE-2026-109618 and CVE-2026-109619 on 26 October. Both due 29 October. Forensic triage Yes on both. Catalog 2026.10.26 / 1758. A CMS update still does not patch the interpreter.

RWP Ventures · 2026-10-27 · event 2026-10-26 · 11 min read · priority 9.3

Do not collapse five facts.

1. The overnight increment is KEV, not first disclosure. PHP shipped 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 on 21 October. CISA’s same-day alert told operators who cannot patch — or who still run PHP 8.1 or earlier without a vendor backport — to take those systems offline. [Our 22 October Daily Top](/posts/2026-10-22-php2shell-cve-2026-109618-109619/) recorded catalog 2026.10.21 / 1754 with neither CVE on it. Yesterday’s [weekly IT](/posts/2026-10-26-weekly-it-runtime-php2shell-plex-litellm/) still had catalog 2026.10.23 / 1756 and still no PHP row. Monday night’s listing is the federal clock and the forensic-triage flag.
2. Thursday is an FCEB due date, not when exploitation started. Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. CISA encourages everyone else to treat KEV the same way. The internet-facing clock started with the 21 October advisory. A ticket that waits for 29 October is late.
3. Forensic triage is Yes on both CVEs. A patched package string is not the close. BOD 26-04 expects agencies to check whether the publicly exposed asset was already taken before the patch went on. Unauthenticated RCE in the interpreter is total control of that worker.
4. A CMS update is still not the patch. These bugs are in php-src. WordPress, Drupal, Magento, Nextcloud, and the rest inherit the runtime. [Yesterday’s Gheist campaign](/posts/2026-10-26-gheist-github-sync-check/) is stolen GitHub tokens. This is not that. CVE-2026-111497 (Brotli in PHP’s Windows builds, 26 October rebuilds) is a separate decoder bug and is not on this catalog.
5. Industrial product notices are not confirmed process impact. Siemens ProductCERT SSA-566512 (23 October) lists RUGGEDCOM APE1808 running Palo Alto Networks PAN-OS as affected by both CVEs. Rockwell published SD1802. That is PHP inside a vendor stack. It is not evidence a PLC, safety system, or physical process was hit.

The operator sentence: if any internet-facing PHP worker was unpatched through Monday, treat Thursday as the federal clock — patch or take it offline, restart every worker, then hunt that worker for shells and unexpected children before you close the CMS ticket.

What happened

CISA’s 26 October KEV alert is two rows and an update to an existing PHP alert. Short descriptions:

CWE lists on both rows: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419. Notes on both: this is an open-source component that different products can ship. Required action is vendor mitigations plus BOD 26-04, including the forensic-triage URL, or discontinue use if mitigations are unavailable.

Those are the only two additions in catalog 2026.10.26. Prior newest rows remain [Arista VeloCloud CVE-2026-114625](/posts/2026-10-23-arista-velocloud-cve-2026-114625/) and [Collabora CODE CVE-2026-110447](/posts/2026-10-24-collabora-code-cve-2026-110447-kev/), both added 23 October and due 26 October.

The exploitation evidence CISA did not republish in the KEV alert. Independent reporting fills the gap between “attempts” and “RCE that ran”:

• 21 October. Amazon MadPot: first attempt 17 October; more 02:00–08:00 UTC 21 October before the embargo lifted; after the patch, Amazon wrote PHP2Shell was broadly exploited, and also that success on real-world systems was not established in that post.
• 23 October. CISA’s PHP-alert update added a Sigma rule and still did not list the pair on KEV.
• 24 October. Adel Karimi (Perplexity) reported confirmed RCE on honeypot Apache mod_php / PHP 8.4.26: usable memory disclosure, then a follow-on execution payload. Karimi’s own caveat, relayed 27 October: the chain was shown on an intentionally favorable single-worker mod_php profile. It is not a reliability measurement on other worker counts, builds, or applications.
• 26 October, 22:24 UTC. CISA catalog 2026.10.26 / 1758. Both CVEs on KEV. PHP alert updated the same day to say so.

BleepingComputer (27 October, 04:20 ET) and The Hacker News the same morning independently reported the listing and the Thursday due date. CISA has not published a victim census, actor name, or ransomware overlay with the add.

Why it matters

Three operational reasons this is the daily.

First, the federal clock is three days on an interpreter that other products embed. FCEB agencies that still have internet-facing PHP on an affected build have until Thursday. BOD 26-04 also wants a pre-patch compromise check on publicly exposed assets that grant total control. That is a hunt, not a yum update screenshot.

Second, the false close is still the application version. The 22 October assessment has not changed: php -v on a distro host can keep the old upstream number after a backport; a package on disk with the old process still mapped is the unpatched interpreter; a WAF hit count is not the patch. PHP’s own line remains: there are no complete mitigations.

Third, the asset register will miss the copies you do not think you run. CISA: PHP is often a component of other software and prevalence may not be directly observable. Siemens’ RUGGEDCOM APE1808 notice is the industrial illustration — PAN-OS on an application-hosting platform, patch path “contact customer support.” Censys is running a live PHP2Shell exposure tracker against the four fixed trains. Secondary reporting cites very large still-affected populations. Those are exposure figures, not a compromise census.

Who / what is affected

• Any PHP that serves web requests: Apache mod_php (highest demonstrated risk), PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. CLI-only PHP is outside the web-request scope; do not use that to skip FPM on the same box.
• Upstream floors (unchanged): 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12. PHP 8.1 and older: no point release from the project; distro/LTS backport or take offline.
• Applications: every PHP app inherits the runtime. Lab reproductions against named CMS versions are not a victim list.
• Vendor appliances / OT-adjacent stacks: CONFIRMED product notices include Siemens SSA-566512 (RUGGEDCOM APE1808 with PAN-OS 10.2 / 11.1 / 11.2 / 12.1 / 12.2) and Rockwell SD1802. Process impact: UNKNOWN. Do not treat a PHP RCE on an engineering portal, historian UI, or ruggedized PAN-OS host as confirmed physical-process compromise.
• Not this KEV row: [Gheist](/posts/2026-10-26-gheist-github-sync-check/) (stolen GitHub tokens). FortiSandbox CVE-2026-107656 (FG-IR-26-185, CVSS 9.6, Known Exploited: No, not in catalog 2026.10.26). PHP Windows CVE-2026-111497. PHP informational CVE-2026-115560.

Technical context

High-level, from the PHP advisories and the KEV short descriptions. This is not an exploit recipe.

CVE-2026-109618 — RCE via out-of-memory corruption. PHP used longjmp() for OOM. In some contexts request memory is reachable before it is fully initialized; cleanup can then read or branch on invalid state. PHP validated unauthenticated RCE over HTTP against Apache mod_php with default input and memory limits, before application code. The 21 October patch replaces OOM longjmp() with a delayed soft OOM at the next VM safe point.

CVE-2026-109619 — RCE via stale global state. Worker-global session, error, object, or extension state can keep pointing at request-owned memory after that heap is freed. A later request on the same worker consumes it. Confirmed consumers include session upload progress (on by default; no session_start() required). Validated on mod_php and FPM.

Partial stopgaps PHP listed in October (memory_limit=-1, session.upload_progress.enabled=0, PHP 8.5 fatal_error_backtraces=0, pm.max_requests=1) close named paths. They do not make an install safe. CISA still allows a WAF as a buffer until the update. Neither is the KEV required action.

ATT&CK (defensive mapping, not attribution): T1190 exploit public-facing application; execution as the PHP worker (T1059). Follow-on webshells, miners, or ransomware in production: UNKNOWN in this retrieval. CISA’s hunt hint, unchanged from 21 October: PHP worker processes launching shells or downloading tools.

Threat / exploitation status

What defenders should do

1. Inventory PHP that serves HTTP, not “the WordPress estate.” FPM pools, mod_php vhosts, containers, panels, appliances, vendor UIs, and ruggedized PAN-OS hosts. Package queries: dpkg -l 'php' / rpm -qa 'php'. Running binaries: php -v and php-fpm -v after the restart.
2. Patch, then restart. Upstream: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Distro: the vendor advisory package, not the three-part upstream string. **Reload Apache / restart every php*-fpm.** A package upgrade without a restart leaves the old interpreter mapped.
3. EOL PHP: vendor backport or upgrade the branch. If neither is possible, CISA’s 21 October line still stands and now sits under KEV: take the PHP-based system offline.
4. Treat internet-facing unpatched-through-Monday as a hunt, not a patch ticket. CISA forensic triage is Yes. Look for PHP workers spawning shells or downloading tools; unexpected files under the web root or /tmp; new cron; outbound from the worker account; credentials the worker could read (.env, database passwords, API keys). Rotate those from a clean identity. That is BOD 26-04 hygiene on a total-control KEV, not a confirmed-compromise assertion for every host.
5. Do not close on a WAF or a CMS bump. Keep WAF rules on. Do not treat Cloudflare / other virtual patching as the KEV required action.
6. Vendor appliances: read the product PSIRT, not php.net, for the floor. Siemens APE1808: PAN-OS path via Palo Alto, Siemens says contact support. Rockwell: SD1802. Do not mark the plant floor “PHP-free” because there is no WordPress.
7. Federal / BOD 26-04 clock: both CVEs due Thursday 29 October. Collabora 110447 and Arista 114625 were due yesterday. Those clocks did not pause; they are separate tickets.
8. Do not merge adjacent bugs onto this row. [Gheist](/posts/2026-10-26-gheist-github-sync-check/) is token theft. FortiSandbox 107656 is an unauthenticated GUI bypass with Known Exploited: No. Brotli 111497 is a Windows PHP rebuild.

RWP is not publishing exploit code, PoC repositories, or a how-to for the OOM or session-progress paths.

RWP assessment

High confidence that CISA listed both PHP2Shell CVEs on 26 October, that catalog 2026.10.26 / 1758 is the current feed, that both rows carry due 29 October and forensic triage Yes, and that the 21 October releases remain the documented close.

High confidence that updating an application without updating and restarting PHP does not remediate, and that this listing is a material increment on the 22 October Daily Top and on yesterday’s weekly IT, both of which recorded the CVEs off KEV.

Moderate confidence in successful in-the-wild RCE beyond sensors. CISA’s KEV criteria require evidence of exploitation; that is the federal confirmation. Karimi’s 24 October honeypot is independent technical reporting of a completed chain on a favorable mod_php profile. Amazon’s 21 October “broadly exploited” sentence remains sensor pressure. No public named victim. Sensor RCE is not a breach ledger.

Low confidence in actor identity and in any ransomware overlay. KEV field is Unknown. None is in the current record.

Confidence that this is not OT process impact: high. Siemens and Rockwell published product notices. No evidence in this retrieval that a controller, safety system, or physical process was affected.

This outranked FortiSandbox CVE-2026-107656 (critical unauthenticated bypass, PSIRT Known Exploited: No, not in catalog 2026.10.26), CERT-UA’s Dahua camera alert (regional, not KEV), Huntress’s M365 token-spray (campaign closed 22 September; already considered 26 October), and the 26 October PHP Windows Brotli rebuild (different CVE, not KEV). Collabora and Arista are yesterday’s due dates on already-published Daily Tops.

What we are watching

• A confirmed production victim, a named payload (webshell, miner, ransomware), or CISA IOCs attached to these rows. Ransomware field is still Unknown.
• Distro and appliance floors that still ship affected PHP under old version numbers, including PAN-OS on RUGGEDCOM APE1808.
• Whether CVE-2026-115560 or CVE-2026-111497 move from adjacent to exploited. Neither is on catalog 2026.10.26.
• FortiSandbox CVE-2026-107656 if PSIRT or CISA flips exploitation status.
• [Gheist](/posts/2026-10-26-gheist-github-sync-check/) persistence after branch deletion. Not this product.

Sources

Primary: CISA 26 October KEV add alert; CISA PHP alert updated 26 October; CISA KEV JSON catalog 2026.10.26 / 1758; PHP 21 October advisory and GHSA pair; CVE-2026-109618 / CVE-2026-109619; BOD 26-04 implementation guidance; Siemens SSA-566512; Rockwell SD1802. Independent: BleepingComputer 27 October; The Hacker News 27 October; Amazon MadPot 21 October; Censys PHP2Shell tracker. Adjacent, not this story: Fortinet FG-IR-26-185. Prior RWP: PHP2Shell Daily Top 22 October; weekly IT 26 October; Gheist Daily Top 26 October; Collabora 24 October; Arista 23 October.