The US Cybersecurity and Infrastructure Security Agency (CISA) has put both PHP2Shell flaws in its Known Exploited Vulnerabilities catalogue. It made the change on Monday, according to its alert. Federal civilian agencies have until Thursday, 29 October, to fix CVE-2026-109618 and CVE-2026-109619.
Last week, CISA warned about the flaws but said it had not seen them exploited. David DiMolfetta reported the change for Nextgov/FCW. The new catalogue entries do not name victims or describe the evidence behind the decision. On Thursday, officials in several countries still saw no confirmed break-ins.
What the honeypots recorded
The most detailed public evidence so far comes from Adel Karimi, detection and response lead at Perplexity. His honeypots are decoy servers built to attract attackers. On Saturday, 24 October, they recorded 35 shell commands started by the Apache web server. He set out the evidence in a report on GitHub.
The three targets ran PHP 8.4.26 under Apache’s mod_php. The shells came from two IP addresses, which the report says are not an attribution to two actors. The attackers then tried to reach outside servers with PHP, curl and wget. The report shows no malware download. The evidence matches CVE-2026-109618 and does not show the second flaw in use.
On X, Karimi called it confirmed remote code execution with usable memory disclosure. Sergiu Gatlan reported his posts for BleepingComputer. Karimi also warned that his honeypots used a single-worker setup that favours the attack. The results do not measure how reliably the exploit works on other servers. Marcus Hutchins, a threat researcher at Expel, also confirmed the findings.
“This is by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far,” Hutchins wrote on X.
A claimed chain into 25 servers
Dream, the Israeli security company co-founded by Pegasus creator Shalev Hulio, published a separate account on Monday. In a blog post, it said it found traces of a campaign that rooted 25 servers. They included systems in a US government-affiliated environment. The attackers took 24 firewalls and one internal management server.
According to Dream, the attackers paired PHP2Shell with Fragnesia (CVE-2026-46300). That Linux kernel flaw can give an attacker root access. They decrypted an LDAP service account password and listed every user and group in the domain. Dream could not determine whether later steps, such as creating a backdoor account, succeeded.
Investigators found Claude Code installed, and an attack platform set up with the Chinese models DeepSeek and Kimi. Dream said it had no direct evidence that these tools wrote the exploit. It also said the operation did not appear to be a fully autonomous nation-state attack.
“We do not attribute this activity to a named threat actor. However, multiple indicators point to a Chinese-nexus operation,” Dream wrote.
TNW has not independently verified Dream’s findings.
How far it has spread
Delft University of Technology’s Threat Intelligence Lab tracks the attacks on a public dashboard. By Tuesday evening, it had logged 68,499 exploitation requests from 652 IP addresses in 73 countries since 21 October. Of those addresses, 174 sent code or a dropper, a small program that fetches malware.
Some earlier claims did not hold up. Sophos corrected a report of successful attacks on its customers. Its telemetry showed only scanning and a few failed attempts. Palo Alto Networks’ Unit 42 also withdrew its assessment that attackers used PHP2Shell against a European government agency.
PHP fixed both flaws on 21 October, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AI tools had found both bugs first. The PHP team says the risk is highest for mod_php and that there are no complete mitigations. On Monday, it also shipped Windows builds with a fix for the Brotli flaw. CISA has told organisations that cannot update quickly to take their systems offline.
