The facts

  1. CISA’s official catalog records both vulnerabilities as added on 26 October, identifying them as known to have been exploited. Its entries list use in ransomware campaigns as unknown. [3]

  2. CISA separately added Linux-kernel flaw CVE-2026-46300 on 28 October. Its entry explicitly describes chaining it with the two PHP flaws to implant webshells and run commands as root. This classification does not establish the identities of the campaign’s victims or perpetrators. [3]

  3. The vulnerabilities can allow attackers to run code on vulnerable servers without signing in. ENISA, CERT-EU, Europol and the European Commission jointly called for immediate action. [2]

  4. PHP’s fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project says web-serving installations, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, are at risk. [1]

  5. CVE-2026-109618 concerns memory corruption during out-of-memory handling. CVE-2026-109619 concerns request state surviving after its memory has been freed. [1]

  6. PHP says updating is the complete remedy. Its listed mitigations address particular attack paths and do not make an unpatched installation safe. [1]

  7. The EU joint statement advises prioritising internet-facing systems, coordinating with service providers and considering temporary isolation where immediate patching is impossible. [2]

  8. Dream’s 26 October research describes attacks on 23–24 October that combined the PHP flaws with Linux-kernel vulnerability CVE-2026-46300 to compromise firewall systems, including a US government-affiliated environment. [4][5]

  9. The firm did not disclose the appliance vendor. Its Chinese-nexus assessment and suggestion of AI-assisted tooling are research assessments, not independently established state responsibility or proof of AI authorship. [4][5]

Relevant context

The later Brotli dependency update in PHP’s Windows packages addresses a separate vulnerability, CVE-2026-111497. [1]

Still unconfirmed

  • The affected appliance products and organizations and responsibility for the reported campaign have not been independently established in the checked public evidence.

Corrections & updates

Update: Added the exploitation status recorded by CISA on 26 October, which the original report omitted. Both flaws are in the Known Exploited Vulnerabilities catalog; the PHP release date and fixed versions are unchanged.

Update: Added Dream’s 26 October report of a PHP2Shell/Linux-kernel exploit chain targeting firewalls, corroborated as a research report by SecurityWeek on 28 October. Vendor and state-attribution uncertainties are explicit. The original PHP fixes and CISA classification are preserved.

Update: Added CISA’s 28 October exploitation listing for Linux-kernel CVE-2026-46300 and the agency’s description of its use with the PHP flaws. This provides an official exploitation classification for the kernel component; campaign victims and attribution remain research assessments.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 01:08 UTC.

Dream’s campaign findings remain attributed research reported by SecurityWeek. CISA’s 28 October catalog independently classifies the Linux component as exploited and describes its PHP chain; it does not verify Dream’s specific victim identities or attribution. PHP’s fixed versions and the PHP entries’ 26 October addition dates are preserved.

  1. Critical PHP remote-code-execution security advisory

    PHP Project · Primary source · 21 Oct 2026

  2. Joint statement on critical PHP vulnerabilities

    European Union Agency for Cybersecurity (ENISA) · Primary source · 21 Oct 2026

  3. Official KEV catalog — PHP flaws and Linux exploit-chain component

    US Cybersecurity and Infrastructure Security Agency (CISA) · Primary source · 28 Oct 2026

    CISA’s official GitHub mirror, catalog version 2026.10.28. The PHP entries were added 26 October; Linux CVE-2026-46300 was added 28 October.

  4. Research findings on chained PHP2Shell firewall attacks

    Dream Research · Primary source · 26 Oct 2026

    Researcher-observed artifacts and attribution assessment; affected organizations did not independently confirm the campaign in the checked sources.

  5. Reporting on Dream’s PHP2Shell firewall findings

    SecurityWeek · Reporting · 28 Oct 2026

    Independent newsroom; its campaign account relies on Dream’s research.

Report a factual error