All posts

PHP2Shell CVEs Now in CISA KEV and Exploited

October 27, 2026 · Senserva Trustworthy AI

Senserva Watch

Join Senserva Watch and get Three Free Unlimited Audits with our full Claude MCP, a fresh audit credit every quarter, alerts when a CVE or KB you follow changes, critical security updates when they land, the Patch Tuesday wire on release day, and 20% off when you buy.

Join Senserva Watch

One email address. No tenant connection, no agent, no call.

The Senserva daily security read, October 27, 2026

PHP2Shell is now exploited and on the CISA KEV list

The two PHP2Shell flaws disclosed in the emergency PHP release of October 21 are no longer theoretical. On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog, and BleepingComputer and Cyber Security News both confirm attacks are hitting universities and business websites using public exploit code. CVE-2026-109618 carries a CVSS of 9.8 and is described as a memory corruption bug; CVE-2026-109619 sits at 8.1 as a stale internal request-state issue. Both allow unauthenticated remote code execution.

This is the clearest patch-now signal of the week. These are not ransomware-linked yet, but KEV listing plus confirmed in-the-wild exploitation means the window to act closes fast. The flaws also topped Hacker News buzz with over 1,400 and 1,200 points respectively, so proof-of-concept activity is widespread. If you run PHP anywhere in your estate, including behind web apps and ingestion pipelines, update to the fixed emergency release immediately.

The Brotli decoder flaw now hits PAN-OS

Tenable and Cyber Security News tie this to a wider issue: CVE-2026-111497, a Google Brotli decoder vulnerability that Tenable is calling Brotli2Shell. Palo Alto Networks has now confirmed the Brotli flaw affects PAN-OS and has released workarounds. If you run Palo Alto firewalls, review the confirmed impact and apply the vendor workarounds until a fix lands. Tenable's FAQ links the Brotli decoder issue directly to the same PHP2Shell CVEs, so treat these as a connected cluster rather than isolated bugs.

Other active KEV movers worth your attention

Beyond PHP2Shell, several high-ranking exploited CVEs remain live and several are ransomware-linked, which is the difference between patching eventually and patching now:

  • CVE-2026-41940 in WebPros cPanel and WHM, CVSS 9.8, KEV listed and ransomware-linked, with an EPSS of 0.985.
  • CVE-2026-35273 in Oracle PeopleSoft PeopleTools, CVSS 9.8, KEV listed and ransomware-linked.
  • CVE-2026-63077 in JetBrains TeamCity, CVSS 9.8, KEV listed and ransomware-linked.
  • CVE-2026-0257, a Palo Alto PAN-OS authentication bypass, CVSS 9.1, KEV listed and ransomware-linked.
  • CVE-2026-110447 in Collabora Online, CVSS 9.8, now KEV listed.
  • CVE-2026-21589 in Atlassian Bitbucket Data Center, CVSS 7.5, KEV listed with an EPSS of 0.995.

Microsoft 365 identity attacks and Apple backports

If you run Microsoft 365, three stories this cycle are about identity, not patches. Cyber Security News reports attackers using AI agents to target more than 2,250 M365 tenants through ConnectWise, a separate campaign hijacking accounts at 79 organizations with stolen login tokens, and threat actors impersonating IT support over Microsoft Teams to gain remote access to employee PCs. Token theft and Teams-based social engineering bypass password resets, so review conditional access, token protection, and any remote-help tooling your users trust.

Apple has backported CoreGraphics zero-day patches (CVE-2026-86950) to older iPhones, and iOS and macOS 27.2 fix 286 bugs overall including an exploited flaw also backported to iOS 18. Push these to managed devices through Intune. This month's Windows cumulative updates, including KB5046616 for Windows Server 2022 with 34 CVEs and KB5046617 for Windows 11 24H2, carry KEV-listed fixes and should already be in your ring rollout.

Do this first

Work the exploited items in order of blast radius and exploitation certainty.

  • Update PHP to the fixed emergency release everywhere, since CVE-2026-109618 and CVE-2026-109619 are KEV listed and confirmed exploited.
  • Apply Palo Alto's PAN-OS workarounds for the Brotli decoder flaw CVE-2026-111497 and prioritize the PAN-OS authentication bypass CVE-2026-0257.
  • Patch the ransomware-linked KEV entries: cPanel, Oracle PeopleSoft, and JetBrains TeamCity.
  • Review M365 token protection, conditional access, and Teams remote-help trust after this week's identity campaigns.
  • Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft CVE tracker to confirm your PHP and PAN-OS exposure against the latest KEV additions.

Sources

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-27.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.

All posts

Patching across Intune, Windows Autopatch, Defender, Azure, and your endpoint managers: see Senserva patching in action.