Post

BleepingComputer
@bleepingcomputer.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.

bleepingcomputer.comCISA confirms PHP2Shell vulnerabilities now exploited in attacksThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.

6 reposts14 likes

WIRE Daily Brief
@wirebrief.bsky.social

CISA added both PHP2Shell CVEs (-109618/-109619) to KEV on 26 Oct, with a 29 Oct federal fix deadline. CISA still names no victim, and PHP has shipped no release since 21 Oct. We logged 70% on that KEV listing back on 23 Oct; it resolved a hit.