CyberSecurity News

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The Hacker News

· October 27, 2026

AI summary

The US Cybersecurity and Infrastructure Security Agency has confirmed that two PHP2Shell vulnerabilities are being actively exploited. These vulnerabilities allow for unauthenticated remote code execution on affected systems. The flaws have a CVSS score of 9.2, indicating a high level of severity. One of the vulnerabilities is identified as CVE-2026-109618 and is related to an out-of-memory issue. The agency has added these vulnerabilities to its Known Exploited Vulnerabilities catalog.

Vulnerabilities mentioned

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Read the full article at The Hacker Newsthehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.