CISA Sets October 29 Deadline for Federal Agencies to Remediate PHP2Shell Flaws

On October 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, to its Known Exploited Vulnerabilities (KEV) catalog. CISA directed federal civilian agencies to remediate the flaws by October 29, 2026 and conduct forensic triage for signs of compromise. That deadline is today. The catalog action escalated the federal response: CISA’s initial warning the prior week said the agency had not observed exploitation, while the later designation confirms active exploitation without identifying victims or explaining the evidence behind the listing. The scale of successful attacks therefore remains unclear, even as agencies face a firm remediation deadline.

The vulnerabilities can allow an attacker to run commands on a vulnerable web server without an account or password, potentially enabling data theft or website changes. PHP supports common web functions such as processing forms and retrieving information, and is used by websites built on platforms including WordPress and Drupal. Because the flaws reside in PHP itself, updating a site’s own code and plugins does not necessarily address the risk. Agencies and service providers must identify PHP installations across their environments—including components embedded in other software—and prioritize internet-facing systems. CISA has advised taking systems offline when they cannot be promptly updated, making mission impact, continuity planning, and operational coordination central to remediation decisions.

For federal contractors, the directive translates into urgent operational tasks across federal websites, applications, hosting environments, containers, and cybersecurity operations. Teams may need to inventory software, establish which PHP versions are deployed, determine external exposure, test available fixes, and document that remediation worked. Unsupported or tightly integrated systems may call for compatibility engineering, isolation, or coordination with product providers to obtain supported fixes. Contractors supporting systems that handle Controlled Unclassified Information (CUI) should also assess whether delayed remediation or a confirmed compromise triggers contractual, regulatory, insurance, or False Claims Act concerns. The order does not name a procurement vehicle, solicitation, or proposal deadline, but it could prompt near-term tasking or demand for discovery, patching, threat hunting, and supply-chain visibility services.

The broader reporting underscores both the urgency and the uncertainty. Cloudflare reported millions of attempted attacks, but security firms later qualified earlier claims of successful exploitation: Sophos said its initial report reflected scanning and failed attempts, while Palo Alto Networks’ Unit 42 said it could not confirm PHP2Shell as the entry point in an attack against a European government agency and retracted its earlier assessment. A Nextgov/FCW review found roughly 900 Shodan search results associated with federal, state, and local government websites showing signs of PHP use, although those results do not establish that systems remain vulnerable. Meanwhile, Censys reported more than 10 million services patched since October 21, and PHP’s developers released fixes the prior week. As Hemant Baidwan, Chief Information Security Officer at Knox, put it: “The challenge is not just patching. Teams first have to identify where the vulnerable component exists, determine whether it is externally exposed, understand the mission impact, test the fix, and validate that remediation actually worked.”

• CISA set October 29, 2026 as the remediation deadline for federal civilian agencies; prioritize any remaining remediation and required forensic triage immediately.
• The affected flaws are CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell; the reported risk includes unauthenticated command execution on vulnerable web servers.
• Agencies and contractors should locate PHP across direct deployments and embedded components, beginning with internet-facing systems and validating both patch status and exposure.
• If a system cannot be promptly secured, CISA’s guidance is to take it offline; contractors should coordinate operational alternatives and mission-impact decisions with agency stakeholders.
• Unsupported deployments may require compatibility work, isolation, or coordination with product providers to obtain supported fixes.
• For CUI environments, contractors should review potential contract, regulatory, insurance, and False Claims Act exposure if remediation is delayed or compromise is identified.
• Attack reporting remains mixed: Cloudflare reported millions of attempts, while Sophos and Palo Alto Networks’ Unit 42 qualified or retracted earlier claims about successful exploitation.
• A Nextgov/FCW review found roughly 900 Shodan results linked to government websites with signs of PHP use; the results do not confirm current vulnerability or compromise.
• Censys tracked more than 10 million services patched since October 21, and PHP developers released fixes the prior week, indicating a large and ongoing global repair effort.
• Potential contractor demand includes software-asset discovery, vulnerability remediation, forensic review, compromise hunting, and supply-chain visibility; no specific procurement vehicle or proposal deadline has been announced.