Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: October 27, 2026
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 26, 2026
CISA added both PHP2Shell vulnerabilities to the KEV catalog on October 26, with a remediation deadline of October 29, this Thursday. Readers of our two KEV Watch editions have had nearly a week of lead time. For everyone else, the deadline arrives fast, and the more pressing problem is that exploitation began long before the listing. Any internet-facing PHP system that went unpatched last week should be treated as a candidate for compromise, not just a patching ticket.
What Changed: From Attempts to Confirmed Exploitation
Last Friday, CISA's alert said it had "not observed successful exploitation." The KEV listing means that has changed. CISA has not published the evidence behind the listing, but third-party reporting describes the scale of the activity that preceded it.
Mass exploitation started almost immediately. Cloudflare researchers reported tens of thousands of exploitation attempts within the first 45 minutes after disclosure, hundreds of thousands within two hours, and millions by October 22. Whatever the success rate, the volume means virtually every exposed PHP server has already been tested.
At least one organized campaign is working through a target list. Threat intelligence firm Cyfirma reports a group it suspects is linked to North Korea, coordinating over a private I2P channel it has monitored since October 22. On October 24, the operators reported 216 unpatched or partially mitigated hosts and named 21 scanning nodes, with about a third of the targets checked at that point. The same addresses were seen running web-shell tooling and upload-progress session-poisoning attempts. The attribution comes from a single vendor and should be treated as an assessment, but the tradecraft details are useful to defenders regardless of who is behind them.
The scanning is built to stay quiet. Cyfirma describes slow, low-volume scanning from rotating machines, with any node that hits filtering or rate limiting retired. Rate-based alerting is unlikely to catch it. Organizations that judged their exposure by the absence of noisy alerts last week should not take comfort from that.
Operational guidance: Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or verify the fix through your distribution's security advisory, and restart PHP services so the patched code is running. Systems on PHP 8.1 or earlier, which receive no official fix, should be taken offline until upgraded or patched through a vendor backport.
Assume Compromise Where the Window Was Open
With exploitation running at this scale since October 21, patching alone does not settle the question for any system that was exposed and unpatched during that period. Patch first, but preserve logs before you do, and then hunt.
- Web shells. Check web roots and upload directories for PHP files created or modified since October 21, especially in paths your application doesn't normally write to.
- Upload-progress session poisoning. This is the technique the public proof-of-concept relies on, and it matches activity reported in the wild. Review requests carrying upload-progress fields and unexpected session files.
- Process behavior. Alert on PHP worker processes (php-fpm, httpd, apache2, lsphp) spawning shells or download tools such as curl and wget. CISA's SIGMA rule, published in its SIGMA Rules GitHub repository, covers this ground and is the fastest way to get detection running.
- Low-and-slow requests. Because the scanning deliberately avoids rate thresholds, search logs for the request patterns themselves rather than spikes in volume.
If you find evidence of compromise, rebuilding from a known-good state is safer than cleaning in place: web shells are cheap to plant in multiple locations, and credentials stored on the server, such as database passwords and API keys, should be rotated.
Operational guidance: For federal agencies and contractors, document each internet-facing PHP system with two answers: when it was patched, and what the hunt found. A system that was exposed from October 21 until the patch should be recorded as a compromise assessment under BOD 26-04, not closed as a routine update. Expect agency customers to ask for exactly that record.
Summary Deadline Status
| CVE | Product | Fixed In | KEV Added | Deadline | |---|---|---|---|---| | CVE-2026-109618 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 26 | Oct 29 | | CVE-2026-109619 | PHP (all web SAPIs) | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | Oct 26 | Oct 29 |
Both entries are due Thursday. PHP 8.1 and earlier have no official fix, so for those systems the only compliant paths are an upgrade, a vendor-backported package, or discontinuing use.
Sources: CISA: Two KEV Additions (Oct 26) · CISA Alert: Critical Vulnerabilities in PHP · CISA KEV Catalog · PHP Security Advisory · Security Affairs: CISA Adds PHP2Shell to KEV · CISA SIGMA Rules Repository · SOCRadar: PHP2Shell · Tenable: PHP2Shell FAQ
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 29, 2026
CISA Adds Actively Exploited E-Commerce Vulnerabilities to KEV Catalog
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog as researchers report active exploitation against Adobe Commerce and e-commerce platforms. CVE-2026-48356 (PolyShell) and CVE-2026-111497 (Brotli/Node2Shell) are being exploited for remote code execution, according to CISA and Bleeping Computer. The Hacker News reports that PolyShell attacks have breached hundreds of online stores, though the exact compromise count and whether these represent confirmed incidents or researcher observations has not been specified. The Brotli vulnerability, which Bleeping Computer describes as a "critical" Node2Shell flaw, allows attackers to achieve remote code execution. The addition to CISA's catalog indicates federal agencies observed active exploitation in the wild, triggering mandatory remediation requirements for federal civilian networks under Binding Operational Directive 22-01.
Nonprofit Publishes DHS Personnel Data Following March Breach
Transparency collective Distributed Denial of Secrets published personal information on more than 40,000 Department of Homeland Security employees following a breach the group Department of Peace claimed responsibility for in March 2026, according to multiple outlets including NPR, The Guardian, and Wired. The leaked data includes names, phone numbers, email addresses, office assignments, and in some cases home addresses of personnel across DHS agencies including ICE. Wired reports the dataset includes information on undercover ICE agents, though the extent to which operational security has been compromised remains unclear. DDS co-founder Emma Best confirmed the organization received the data from Department of Peace and Swiss hacker maia arson crimew, then created a searchable online database. The initial March compromise reportedly involved documents related to contracts with outside vendors; whether the personnel data represents an expansion of that breach or a separate intrusion has not been disclosed. DHS has not publicly confirmed the breach scope or validated the authenticity of the published records.
Sources: The Hacker News · Bleeping Computer · NPR · The Guardian · Wired
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Volt Typhoon used the disrupted Silent Train network for four zero-day campaigns targeting enterprise management systems and strategic networks across...
Researchers uncover Volt Typhoon's covert, ephemeral network
Lumen Technologies' Black Lotus Labs reveals that Volt Typhoon has built and dismantled ephemeral malicious infrastructure using the Silent Train fram...
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon uses a framework that relies on rotating chains of connected devices compromised on demand, includi...
Silent Train: Volt Typhoon's Sophisticated Infection Chain into US Targets Exposed
Security researchers reveal the sophisticated tactics Volt Typhoon attackers use to gain access to high-profile targets, steal credentials, and establ...
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
CISA added CVE-2026-48356 (PolyShell) and CVE-2026-111497 (Brotli) to its Known Exploited Vulnerabilities catalog as attackers actively exploit Adobe ...
Hackers expose the identities of more than 40,000 DHS employees | Iowa Public Radio
A hacking group cracked the U.S. Department of Homeland Security's personnel files, exposing the names, phone numbers and addresses of more than ...
Hackers expose the identities of more than 40000 DHS employees - NPR
The Department of Peace also shared the trove of data with Ryan Ottignon, a U.S.-based journalist, and a Swiss hacker known as maia arson crimew.
Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
An activist group published a searchable database exposing personal and professional information on more than 40,000 U.S. Department of Homeland Secur...
Updated daily