PHP2Shell RCE Patched as Exploitation Starts

PHP2Shell: two critical RCE flaws patched, attacks already starting

The headline is PHP. On 2026-10-21 the project shipped emergency patches for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws both rated 9.8. Help Net Security, SecurityWeek, and Cyber Security News all cover the release, and SecurityWeek reports the first exploitation attempts have already hit sensors. A public proof-of-concept is out as well, which shortens the window between disclosure and mass scanning to almost nothing.

National bodies moved fast and in unison. CISA, the UK NCSC, and CERT-EU each published advisories on the same day telling organizations to patch immediately. One writeup pegs the exposure at roughly 70 percent of the internet given how widely PHP runs. On Hacker News, CVE-2026-109618 drew 585 points across 10 stories and CVE-2026-109619 another 371, so this is getting broad attention beyond the usual security press.

Neither CVE is on CISA KEV yet and neither is tagged ransomware-linked in today's data, but with a public PoC, live attempts, and three government advisories, treat this as patch now rather than patch eventually. Update every PHP install you run, including anything behind load balancers and inside container images you build.

New CISA KEV entries: Plex, Siemens, and SiteGuard

CISA added six vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-10-20. Four of them are in Plex Media Server: CVE-2026-96652 and CVE-2026-96655 (both SSRF, 4.3), CVE-2026-96654 (encoded URI scheme neutralization, 6.5), and CVE-2026-96656 (external control of file name or path, 7.2). If anyone in your environment runs Plex, these are now confirmed exploited and need patching.

The other two are CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition, an OS command injection rated 7.8, and CVE-2026-110936 in Siemens Software Center, an uncontrolled search path element rated 6.7. None of the six are flagged ransomware-linked, but KEV listing means attackers are using them in the wild.

What the trusted press adds

Fortinet FortiSIEM has a public exploit for an RCE that requires no login (CVE-2026-106173), per Cyber Security News, so if you run FortiSIEM check your version. Help Net Security reports ransomware crews have been exploiting the Palo Alto GlobalProtect VPN flaw CVE-2026-0257 since June, a reminder that edge VPN gaps stay valuable to attackers for months.

On the ransomware front, Cyber Security News describes Gentlemen ransomware disabling Windows Defender and destroying backups, and Microsoft's own blog details a nation-state campaign (Storm-0940) using ARTEX agentic AI for a ConnectWise supply chain compromise. Rapid7's Q3 data in SecurityWeek says high-severity flaws are being exploited within three days of disclosure, which matches exactly what we are seeing with PHP2Shell.

Among the hot movers still on KEV and ransomware-linked: JetBrains TeamCity CVE-2026-63077, Oracle PeopleSoft CVE-2026-35273, and WebPros cPanel and WHM CVE-2026-41940, all rated 9.8 with high EPSS. Cisco Secure Email Gateway CVE-2026-76519 and two old reliables, ProFTPD CVE-2015-3306 and Apache Struts CVE-2016-3081, remain actively exploited.

Do this first

A focused sequence for today:

• Patch PHP everywhere for CVE-2026-109618 and CVE-2026-109619 now. Public PoC and live attempts make this the top priority.
• Patch or isolate any Plex Media Server (CVE-2026-96652, 96654, 96655, 96656), SiteGuard Server Edition (CVE-2026-106931), and Siemens Software Center (CVE-2026-110936) given the fresh KEV additions.
• Confirm FortiSIEM is updated against CVE-2026-106173 and verify your GlobalProtect fix for CVE-2026-0257 if you run Palo Alto VPN.
• Clear the ransomware-linked KEV backlog: TeamCity CVE-2026-63077, PeopleSoft CVE-2026-35273, and cPanel/WHM CVE-2026-41940.
• Check your Windows October rollups. KB5046616 (Server 2022, 34 CVEs) and KB5046617 (Windows 11 24H2 ARM64, 33 CVEs) are Critical and KEV-tagged.

Where Senserva helps

Senserva's non-Microsoft exploited-CVE tracker follows CISA KEV additions daily, so the Plex, Siemens, and SiteGuard entries from 2026-10-20 are already reflected there. For the Windows side, the free Microsoft Patch Tracker ranks open patches by KEV, EPSS, and ransomware linkage, which helps you sequence KB5046616 and KB5046617 against everything else on your plate. Every CVE and KB named here has a Senserva detail page with the current exploitation picture.

Sources

• Cyber Security News: PHP2Shell Vulnerability Gets a Public PoC Exploit for Security Testing (2026-10-21)
• Cyber Security News: PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers (2026-10-21)
• SecurityWeek: PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors (2026-10-21)
• Help Net Security: PHP2Shell: Critical PHP vulnerabilities patched, update now! (2026-10-21)
• CISA Cybersecurity Advisories: Critical Vulnerabilities in PHP Require Immediate Patching (2026-10-21)
• NCSC: Critical security issue affecting PHP (2026-10-21)
• CERT-EU: 2026-018: Critical Vulnerabilities in PHP (2026-10-21)
• Cyber Security News: Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit That Requires No Login (2026-10-21)
• Help Net Security: Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June (2026-10-21)
• Cyber Security News: Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups (2026-10-21)
• Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (2026-10-21)
• SecurityWeek: High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 (2026-10-21)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-22.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.