CISA Confirms PHP2Shell Exploitation, Orders Federal Agencies to Patch
2026-10-27T20:51:35Z•c04462ed0092a407150e973b466a057ccad4e756a77ef1c47474bd3bdaf55a3d
CVE-2026-109618CVE-2026-109619BrotliCISA KEVLinux privilege escalationMicrosoft .NETMicrosoft TeamsPHPPKIStadia RATStealCTLS certificatesactive exploitationcertificate authority compromisecredential theftexposed industrial control systemsmalwarerefrigeration systemsremote access trojanremote code executionrobotics securitysocial engineering
What happened
HackRead reports active exploitation of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), prompting CISA to add them to its Known Exploited Vulnerabilities catalog and direct U.S. federal agencies to patch. The feed also highlights emergency Microsoft .NET fixes, social engineering through Microsoft Teams external chats, widespread exposure of refrigeration-control systems, compromised eMudhra certificate authority keys, attacks against robotic touch sensors, and the return of StealC as the Stadia RAT. Overall, the reporting indicates active exploitation, high-impact IT/-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hackread
- Record identifier
- c04462ed0092a407150e973b466a057ccad4e756a77ef1c47474bd3bdaf55a3d
- Enrichment time
- 2026-10-27T20:51:35Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.