PHP2Shell KEV Deadline: Federal Agencies Must Patch by Oct 29

Exploitation confirmed. CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26 and set an October 29 compliance deadline for federal agencies under BOD 22-01.

CVE-2026-109618 is an out-of-memory handling flaw in PHP core. CVSS 9.8 critical. CVE-2026-109619 is a stale global-state bug across request boundaries. CVSS 8.1 high. Both allow unauthenticated remote code execution via a plain HTTP request, before any application code runs. Both are patched in PHP 8.3.36, 8.4.27, and 8.5.12.

BleepingComputer confirmed the October 29 federal deadline. The date applies to civilian agencies under BOD 22-01. Private operators are not bound, but CISA’s language reflects a determination that exploitation is active and broad-based.

Confirmed: active exploitation per CISA. Unconfirmed: total organizational scope, attribution.

PHP 8.0, 8.1, and 8.2 are end-of-life. No patches exist for those branches. Affected stacks include WordPress, Drupal, Joomla, and any custom PHP deployment backed by a vulnerable runtime.

Cisco Talos noted that exploitation attempts are distinguishable in WAF logs by anomalous POST bodies. Patches are available at php.net for supported branches; EOL branches have no fix path short of a runtime upgrade.

Timeline

• 2026-10-21: Patches ship for PHP 8.3.36, 8.4.27, 8.5.12. First exploitation attempts hit sensors the same day. (SecurityWeek)
• 2026-10-22: Broad exploitation confirmed, patch adoption tracking begins.
• 2026-10-25: Government entity confirmed compromised; attackers use agentic AI tools in post-exploitation phase. (The Hacker News)
• 2026-10-26: CISA adds both CVEs to KEV, sets October 29 federal deadline. (Our coverage)
• 2026-10-27: KEV listing confirmed by multiple outlets. Deadline is 48 hours out.

Sources: CISA KEV, BleepingComputer, The Hacker News, NVD CVE-2026-109618, NVD CVE-2026-109619