CISA confirms PHP2Shell under attack as researchers clock successful exploits
Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells
Read at The Register (security)
- Vendor
- PHP
- Product
- PHP
- EPSS
- 1.00 (p100)
- Exploitation
- observed in the wild
- Exposure class
- Web platform
Why it ranks 61 (High)
- Exploitation observed in the wild
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Covered by 37 independent sources
- Reporting
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- The Register (security) (theregister.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.