[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb2yYec1ITyxDOLZ20K6mlTH_tbQyNBRWsq9JnTB3B2o":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e21d4d2a-7984-4571-9408-328be94fe6fb","U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog","u-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog-5e0afd","U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws […]","CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities (KEV) catalog. These flaws, present in PHP versions handling web requests since PHP 5.4, allow remote code execution without authentication. Exploitation attempts surged rapidly after their disclosure, with a North Korea-linked group actively scanning for and targeting vulnerable hosts.","CISA adds PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog.","https:\u002F\u002Fsecurityaffairs.com\u002F201840\u002Fsecurity\u002Fu-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2020\u002F07\u002FCISA.jpeg","2026-10-27T10:39:41+00:00","2026-10-27T12:00:12.217876+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"PHP","vendor",{"name":21,"type":22},"PHP2Shell","product",{"name":24,"type":19},"CISA",{"name":26,"type":27},"North Korea-linked group","threat_actor",{"name":29,"type":30},"I2P","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-109618","PHP Memory Corruption Vulnerability",{"type":56,"value":60,"context":61},"CVE-2026-109619","PHP Stale Internal Request-State Vulnerability",[18,24,21],{"controls":64,"vendors":147},[65,94,122],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":95,"product_name":119,"url":120,"description":121},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":53,"name":123,"problem":124,"products":125},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":143,"product_name":144,"url":145,"description":146},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"php2shell-rce-flaws-added-to-cisa-kev-as-nation-state-actors-actively-exploit-unpatched-servers","PHP2Shell RCE Flaws Added to CISA KEV as Nation-State Actors Actively Exploit Unpatched Servers","Two critical remote code execution vulnerabilities in PHP, collectively dubbed PHP2Shell, were rapidly weaponized after disclosure, with exploitation surging before many organizations could act. Because these flaws have existed across PHP versions since 5.4 and require no authentication to exploit, unpatched internet-facing servers represent an extremely low-barrier entry point for attackers. A North Korea-linked threat group was observed actively scanning for and targeting vulnerable hosts, demonstrating that nation-state actors move quickly to capitalize on high-severity, widely deployed vulnerabilities. The inclusion in CISA's KEV catalog signals that exploitation is confirmed in the wild, meaning any organization still running a vulnerable PHP version is at immediate, concrete risk. This incident underscores that delayed patching of critical, internet-facing software components can have severe consequences, particularly when attackers can achieve full system compromise without credentials.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":167,"PCI DSS Requirement 6":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires essential and important entities to implement measures for incident handling and vulnerability management; the active exploitation by a nation-state group highlights the regulatory obligation to patch critical vulnerabilities without undue delay.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely fashion; any cardholder data environment running vulnerable PHP would be in direct violation given the critical severity and active exploitation of PHP2Shell.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner — a structured flaw remediation process tied to CISA KEV alerts would have driven urgent patching of PHP2Shell upon disclosure.","PHP2Shell directly exemplifies this risk category — the vulnerable PHP runtime is a widely used component, and OWASP A06 specifically calls for inventorying and promptly updating software components with known vulnerabilities.","PHP2Shell had a known patch available; a program of continuous vulnerability scanning with enforced remediation deadlines would have ensured vulnerable PHP versions were identified and updated before nation-state actors could exploit them.","This control mandates timely identification and remediation of technical vulnerabilities in software in use; had it been applied, the long-standing vulnerable PHP versions would have been tracked and patched before active exploitation began.","Because PHP2Shell requires no authentication to exploit, enforcing strict access controls and WAF policies around web-facing PHP applications would have raised the barrier for attackers even before patching was complete."]