PHP2Shell Hits CISA KEV: Inside the CVE-2026-109618 & CVE-2026-109619 Exploitation Wave (Plus the "Broccoli2Shell" Windows Curveball)

If your week started with an emergency CISA Known Exploited Vulnerabilities (KEV) ticket landing in your queue, you are in massive company...

On October 26, 2026, CISA officially added CVE-2026-109618 and CVE-2026-109619—collectively tracked across the industry as PHP2Shell—to the KEV catalog, locking in a 72-hour remediation deadline of October 29, 2026, for publicly exposed federal and enterprise assets.

With PHP powering roughly 70% of the web and Censys estimating over 32.51 million active PHP services still running vulnerable versions, PHP2Shell isn't just a web developer problem—it is an enterprise infrastructure, appliance, and identity problem. And to complicate patch cycles even further, Windows administrators who rushed to patch last week now have a second emergency PHP build to deploy thanks to a newly disclosed Brotli decompression flaw (CVE-2026-111497).

Let's break down what is actually happening on the wire, why traditional vulnerability scanners miss hidden PHP footprints, and what you need to execute before the October 29 deadline.

The Anatomy of PHP2Shell (CVSS v4.0: 9.2)

The PHP Foundation released emergency patches on October 21, 2026, for two distinct pre-authentication Remote Code Execution (RCE) flaws. Because both flaws trigger during early HTTP request parsing—often before your web application's authentication logic or routing code even executes—any endpoint accepting untrusted HTTP traffic is at risk.

The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments -

CVE-2026-109618 - An out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

CVE-2026-109619 - A stale internal request-state vulnerability that allows for unauthenticated remote code execution.

Confirmed In-the-Wild Exploitation: From Crashes to Memory Leaks and RCE

Early after the October 21 patch release, defenders saw millions of noisy scans crashing PHP workers. However, on October 24, 2026, detection researchers (including Perplexity's Adel Karimi) captured confirmed, multi-stage RCE chains against honeypot systems running Apache mod_php:

Stage 1 (Memory Disclosure)

The attacker triggers the flaw to force an 800 KiB decoded cookie memory dump back in the HTTP response, bypassing ASLR by leaking live memory addresses.

Stage 2 (Offset Calculation & Payload Execution)

The exploit calculates a target function address directly from the leaked memory dump using pre-computed offsets and fires a second request that achieves full remote command execution, using curl, wget, or the PHP CLI to pull second-stage payloads.

Even more concerning for enterprise defenders: threat intelligence teams (including Unit 42) have already observed attackers pairing PHP2Shell initial access with automated post-exploitation scripts that immediately scrape local Active Directory / LDAP bind credentials, dump multi-factor authentication secrets, and establish NTLM-relay tunnels toward Domain Controllers within two hours of initial compromise.

The "Shadow PHP" Problem: Why Standard Scans Miss It

When CISA says to inventory all PHP assets, many teams check their Linux web servers and move on. In reality, PHP is embedded across enterprise environments in three places that routine patch management overlooks:

• Unregistered Windows Drops: Portable PHP directories (C:\php\php-cgi.exe, XAMPP, WAMP, or legacy IIS FastCGI integrations) dropped onto Windows Servers without MSI installer registration.
• Enterprise Appliances & Management Planes: Over 35 major vendors have already published PHP2Shell advisories to assess or patch embedded PHP components—including F5, Citrix, Palo Alto Networks, Splunk, Okta, Veeam, Synology, QNAP, Aruba/HPE, Ivanti, SonicWall, and Siemens.
• End-of-Life (EOL) Branches: The vulnerable code paths trace all the way back to PHP 5.4.0. Official patched binaries only exist for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. If you are running PHP 8.1, 8.0, or 7.4, there are no official binary builds—only minimal source backports for teams that compile PHP from source.

The Windows Curveball: Why You Need the -1 Builds (CVE-2026-111497)

If you patched your Windows PHP servers between October 21 and October 25, check your build suffixes immediately.

On October 26, 2026, the PHP Foundation issued a second emergency Windows release in five days: 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1.

These -1 builds patch CVE-2026-111497 (dubbed Broccoli2Shell / HTTP2Shell), an out-of-bounds write vulnerability in the Brotli compression library (1.0.3–1.0.9, 1.1.0, and 1.2.0). On Windows PHP builds, if an application uses the cURL extension with automatic HTTP response decompression enabled (CURLOPT_ENCODING), connecting to a malicious or compromised upstream HTTP server that returns a crafted Brotli stream can trigger unauthenticated RCE inside the PHP client process.

Linux/macOS Admins: Update your OS brotli / libbrotli packages to 1.0.10, 1.1.1, or 1.2.1 and restart PHP-FPM or Apache.

Windows Admins: Deploy the -1 PHP Windows builds (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) so you aren't patching twice.

Enterprise Action Plan & CISA BOD 26-04 Compliance

If you operate under federal mandates (CISA BOD 26-04) or strict enterprise SLA tiers, follow this sequence:

1. Respect the Forensic Triage Gate on Internet-Facing Assets: Under BOD 26-04, publicly exposed KEV assets fall under a 3-day mandate, while non-public assets have 14 days. However, if an asset is publicly exposed and suspected of exposure, do not reboot or restart the web service before capturing volatile artifacts. Patching or restarting httpd, w3wp.exe, or php-fpm wipes out process memory and ephemeral /dev/shm or /tmp indicators.
2. Hunt Process & File Telemetry, Not Just Package Databases: Use your endpoint tooling (Tanium Interact/Index/Trace or Microsoft Defender XDR Advanced Hunting) to query for running processes (php.exe, php-cgi.exe, php-fpm, lsphp) and inspect file system binaries for the embedded X-Powered-By: PHP/ version string.
3. Check for the SimpleXML Regression: Note that PHP 8.4.27 and 8.5.12 contain a known bug (php-src #24488) that can crash workers in specific applications utilizing the SimpleXML extension. Setting session.upload_progress.enabled=0 in php.ini acts as a temporary stabilizer until the next point release.
4. Restart the Actual Worker Processes: On Linux, upgrading the php package via dnf or apt updates the binaries on disk, but long-running php-fpm or Apache mod_php worker processes will continue running the vulnerable code in RAM until the service is explicitly restarted.

Did you enjoy CarlsCloud.com™ today and did I help you at all?

If so, buy me a coffee or just shoot me a note via LinkedIn to say thanks it would mean a lot! -Carl