CISA, security researchers confirm successful exploitation of PHP flaws

Security researchers and U.S. government authorities have seen what appears to be the first successful exploitation of critical vulnerabilities in PHP.

For more than a week, hackers have attempted to exploit a memory-corruption vulnerability, tracked as CVE-2026-109618, and a stale internal request-state vulnerability, tracked as CVE-2026-109619. 

Researchers at Perplexity uncovered the first successful exploitation of the vulnerabilities. Perplexity said honeypot sensors detected the activity, and that a threat actor had achieved remote-code execution (RCE).

“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Adel Karimi, detection and response lead at Perplexity, said in a post on X. 

Marcus Hutchins, principal threat researcher at Expel, backed up the findings by Karimi, noting the research was the “highest-quality confirmation” of PHP exploitation that he had seen since the crisis began last week, according to a post on X. 

Hutchins cited the technical breakdown of a successful exploitation attempt targeting an “Apache mod_php installation running PHP 8.4.26.”

The Cybersecurity and Infrastructure Security Agency on Monday added the two flaws to its Known Exploited Vulnerabilities catalog. The agency did not specify exactly what led them to update the catalog, but an agency official pointed to the criteria for active exploitation. 

The…