PHP2Shell Added to CISA's Known Exploited Vulnerabilities Catalog: What OT Owners Should Do Now

The Cybersecurity and Infrastructure Security Agency (CISA) added both "PHP2Shell" vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog on 26 October 2026. The KEV catalog is CISA's list of flaws it has evidence attackers are using in the real world. CISA updated its 21 October PHP alert the same day to reflect the listing. Both flaws let an attacker who has not logged in run their own code on a server that uses PHP to serve web pages, which is called unauthenticated remote code execution.

What changed: until today, public reporting described widespread exploitation attempts against these flaws, mostly against honeypots (decoy servers set up by researchers), without confirmed compromises. A KEV listing means CISA now has evidence of exploitation. CISA gave federal civilian agencies until 29 October 2026, just three days, to apply mitigations, and it marked both entries for forensic triage. That means agencies are expected to check whether a system was already compromised before the patch went on, not just patch it and move on. Those deadlines come from Binding Operational Directive (BOD) 26-04, which applies only to federal civilian agencies, but CISA encourages every organization to treat KEV entries as top priority. CISA lists the use of these flaws in ransomware campaigns as unknown.

Who is affected: CISA says the flaws affect every PHP installation that serves web requests, including Apache with mod_php (which PHP considers the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA says systems that cannot be updated right away, and systems still on PHP 8.1 or older, which no longer receive updates, should be taken offline until they can be patched.

Why this matters for OT owners: PHP rarely appears on an asset list by name. It rides inside vendor products. Industrial vendors have already confirmed it in their products. Schneider Electric's bulletin SESB-2026-295-01 covers EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering. ABB has advisories for its Manufacturing Execution System (MES) and for the B&R APROL process control system. Siemens advisory SSA-566512 covers RUGGEDCOM APE1808 devices running Palo Alto Networks firewall software, where Palo Alto has said hotfixes are planned between 26 and 30 October. Some of these products do not have a fix yet, so the plant team will have to rely on isolation and monitoring for a while.

Where it shows up, plant floor to cloud: field devices and controllers rarely run PHP, but the servers around them often do. Manufacturing execution and production wiki servers, line and energy monitoring, historian and engineering web portals sit in the control network or in the demilitarized zone (DMZ) between business and plant networks. Physical access control servers often bridge security and corporate networks. Firewall management pages at the plant edge are on the list as well. Any of these that serve a web page to people or systems that are not trusted is a way in.

What the Red Tiger team recommends:

1. Find every system that runs PHP, including the ones hidden inside vendor products. Pull the bulletins from Schneider Electric, ABB, B&R and Siemens, and ask your other vendors and integrators in writing whether their products ship PHP.
2. Patch the internet-facing and DMZ systems first. Use the vendor's fixed release where one exists, follow change control on live OT, and test before rolling out. Where no fix exists yet, take the web interface off networks that do not need it and limit access to named administrator machines.
3. Assume a system that was exposed may already have been hit. Before or right after patching, review web server and application logs, and look for PHP worker processes launching command shells, downloading tools, creating new files or making unexpected outbound connections. CISA has published a SIGMA rule, a shared format for log detection rules, to help with this.
4. A web application firewall, which filters malicious web requests before they reach the server, can buy some time, but it is not a substitute for the patch.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: CISA KEV alert, 26 October 2026: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA PHP alert (revised 26 October 2026): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching