CISA (America's cyber agency)
The US agency that warns about exploited flaws.
Listed two of the PHP2Shell flaws as exploited in real attacks on Oct 26 and gave federal agencies until Oct 29 to fix them. It has named no victim.
1incidents on the record
3stories on the Wire
2forecasts
29/100worst incident on the record$137M of AI-generated ads flood the 2026 midterms
Forecasts
- Will America's cyber agency formally warn that the flaw under most websites is being used in attacks, by Oct 31?
graded Oct 26, 2026: yes - Will America's cyber agency order federal agencies to act on the flaw under most websites, by Oct 31?
resolves Oct 31, 2026 · our odds: very unlikely
Incidents on the record
- 29/100 Moderate $137M of AI-generated ads flood the 2026 midterms
Misinformation & fabrication · in the real world
On the Wire
- Federal deadline to fix it: Oct 29 BleepingComputer
CISA added both flaws to its exploited list on Oct 26 but shared no details of the attacks or victims. - PHP2Shell: honeypot shells confirmed, still no named victim and no CISA listing as of Monday morning SecurityWeek
35 shells from two IPs on three decoys Oct 24, on a deliberately favorable setup; no second-stage download seen. - PHP ships emergency fixes for two critical flaws, both scored 9.2; CISA has not confirmed exploitation CyberScoop
PHP ships fixes for CVE-2026-109618 and CVE-2026-109619, both scored 9.2; CISA had not confirmed exploitation at publication.
Spot an error or something out of date? Tell us; corrections are made and logged. Written with AI assistance from public sources; checked against those sources before publishing. General information, not legal, medical or financial advice.