CISA added PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on Oct. 26, signaling federal evidence of active exploitation.
The two PHP bugs—patched Oct. 21—can let attackers run malicious code on vulnerable servers without logging in under certain conditions, a serious risk because PHP powers about 70% of known server-side websites.
Researchers had initially said mass exploitation looked harder than feared, and CrowdStrike had not confirmed successful real-world breaches, but honeypot attacks on Oct. 24 showed 35 command shells launched across three test servers.
The warning lands during what some researchers call "Black October," as Microsoft said a China-aligned group used AI tools to target hundreds of organizations and in some cases gained privileged cloud access in under three hours.
The broader takeaway is that AI is compressing both attack and defense timelines—speeding password spraying, credential abuse and vulnerability research—while forcing companies and users to patch faster and monitor accounts more closely.