CISA Confirms Active PHP2Shell Exploitation — Critical RCE Warning for CWP7 Serv

CRITICAL SECURITY ALERT: CISA CONFIRMS ACTIVE PHP2SHELL EXPLOITATION

Published: October 28, 2026
Severity: CRITICAL — CVSS 9.2
Vulnerabilities: CVE-2026-109618, CVE-2026-109619
Affected Software: PHP
Exploitation Status: CONFIRMED — CISA Known Exploited Vulnerabilities Catalog
CISA KEV Addition: October 26, 2026

---

1. IMPORTANT SECURITY DEVELOPMENT

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities catalog.

Both vulnerabilities allow unauthenticated remote code execution under affected configurations.

The vulnerabilities are:

• CVE-2026-109618 — PHP out-of-memory corruption vulnerability.
• CVE-2026-109619 — PHP stale internal request-state vulnerability.

Both received CVSS 4.0 severity scores of 9.2.

Although these are PHP vulnerabilities rather than vulnerabilities in Control Web Panel itself, they may affect CWP7 servers running vulnerable PHP installations.

CISA added both vulnerabilities to its KEV catalog on October 26, 2026, confirming that exploitation is no longer merely theoretical.

IMPORTANT:

The October 29 remediation deadline applies to affected U.S. federal civilian agencies. Other organizations should nevertheless prioritize immediate remediation.

---

2. WHICH CWP7 SERVERS ARE AFFECTED?

Potentially affected environments include:

• CWP7 servers using vulnerable PHP-FPM installations.
• Apache servers running vulnerable PHP modules.
• Shared hosting environments with outdated PHP versions.
• Websites using unsupported PHP branches without verified security backports.
• Hosting servers where vulnerable PHP workers remain running after an incomplete update.

The vulnerabilities affect PHP runtime components.

Installing the latest CWP version does not automatically establish that every installed PHP runtime has received the required security fixes.

Administrators must check all active PHP installations.

---

3. PATCHED PHP VERSIONS

The PHP project released security updates on October 21, 2026.

Minimum patched upstream versions:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

PHP 8.1 and older no longer receive regular upstream security releases.

Administrators using legacy PHP versions must confirm whether their distribution or PHP vendor provides security backports.

Otherwise, migration to a supported PHP version is recommended.

IMPORTANT:

The PHP version displayed by the command-line interface may differ from the version serving hosted websites.

Each PHP-FPM installation must be examined independently.

---

4. KNOWN EXPLOITATION AND COMPROMISE INDICATORS

Security researchers have reported exploitation attempts involving PHP2Shell.

CISA's inclusion of both vulnerabilities in its Known Exploited Vulnerabilities catalog confirms that the vulnerabilities are being exploited.

However, not every reported attack attempt has been independently confirmed as successful.

Administrators should investigate:

• Unexpected PHP processes executing shell commands.
• Suspicious multipart HTTP POST requests.
• Unusual PHP worker crashes or memory-related errors.
• Unexpected executable files appearing in website directories.
• Unauthorized changes to PHP configuration files.
• Unexpected outbound network connections originating from PHP workers.
• Newly created webshells or malicious scripts.

These are general investigation indicators and do not independently prove PHP2Shell exploitation.

No universal attacker-IP list or malware hash can reliably identify every exploitation attempt.

---

5. SAFE CWP7 INVESTIGATION COMMANDS

The following commands perform read-only checks.

They do not modify files, change firewall rules or restart services.

Step 1 — Identify installed PHP versions



Step 2 — Check PHP package information



Step 3 — Identify active PHP-FPM services



Step 4 — Examine suspicious PHP processes



Step 5 — Check PHP session upload settings



Important:

These checks are preliminary.

They cannot independently determine whether a PHP installation has received vendor-backported security patches.

They also cannot prove that a server has not been compromised.

PHP-FPM pool overrides and application-specific configurations must be examined separately.

---

6. RECOMMENDED IMMEDIATE ACTIONS

Action 1 — Update PHP

Install the appropriate patched PHP versions or verified vendor security backports.

Action 2 — Restart affected PHP workers

After updating, perform controlled PHP-FPM worker restarts to ensure that vulnerable processes are replaced.

Action 3 — Review unsupported PHP versions

Identify hosted websites still running PHP 7.4, 8.0 or 8.1.

Confirm vendor patch availability or plan migration to supported PHP versions.

Action 4 — Review PHP session upload progress

Where application compatibility permits, consider the following temporary mitigation:



This setting must be applied through an appropriate server-level configuration.

It is not a complete replacement for installing PHP security patches.

Action 5 — Maintain layered server protection

• Keep CSF and LFD active and correctly configured.
• Restrict CWP administrative interfaces to trusted IP addresses.
• Disable unnecessary external API access.
• Maintain malicious-file detection and security monitoring.
• Keep hosted applications and extensions updated.
• Maintain verified off-server backups.
• Investigate suspicious cron jobs and unauthorized SSH access.

---

7. OFFICIAL REFERENCES

CISA Known Exploited Vulnerabilities Catalog

CISA — Known Exploited Vulnerabilities

CISA Official KEV Dataset

CISA KEV Data Repository

PHP Security Advisory — October 21, 2026

PHP Critical Remote Code Execution Advisory

PHP Official Website

PHP Project

---

PROTECT YOUR CWP7 SERVER WITH FREESPIRITS

Professional CWP7 security monitoring, server protection and performance optimization.

Modern hosting environments face increasingly sophisticated threats, including malicious file injections, webshells, unauthorized access attempts and resource abuse.

At FreeSpirits Web Services , we develop specialized modules designed to help CWP7 administrators strengthen security monitoring, investigate suspicious activity and improve hosting reliability.

CWP7 SECURITY AUDIT MODULE

A dedicated security auditing and incident-investigation solution for Control Web Panel environments.

• Website security auditing.
• Suspicious and malicious file detection.
• Monitoring potential file-injection activity.
• Security incident reporting.
• Malicious-file quarantine.
• CSF integration for verified security incidents, subject to safety checks.

Explore the module:

CWP7 Security Audit Module — Features and Details

---

CWP7 RESOURCE SHIELD

A server protection solution designed to help prevent excessive resource consumption and improve hosting service availability.

• Resource activity monitoring.
• Protection against excessive resource consumption.
• Monitoring potentially abusive activity.
• Integration with server protection mechanisms.

Explore the module:

CWP7 Resource Shield — Features and Details

---

CWP7 TWEAK MANAGER

A collection of server configuration, security and maintenance utilities designed for CWP7 environments.

• Server configuration checks.
• Security-related maintenance utilities.
• File permission management.
• Network and mail configuration tools.

Explore the module:

CWP7 Tweak Manager — Features and Details

---

CWP7 TURBO MANAGER

A specialized server performance and optimization solution for Control Web Panel environments.

• PHP-FPM configuration management.
• PHP handler management.
• Nginx caching and configuration utilities.
• Server performance optimization.

Explore the module:

CWP7 Turbo Manager — Features and Details

---

NEED PROFESSIONAL CWP7 SECURITY ASSISTANCE?

If your hosting server is experiencing suspicious activity, malicious file injections, unexpected PHP processes or unexplained performance problems, professional investigation can help identify the underlying cause.

FreeSpirits Web Services provides hosting, server administration and technical support services.

Discover our CWP7 solutions:

FreeSpirits Web Services — Official Website

Monitor threats. Strengthen security. Protect your hosting infrastructure.

---

Security Disclaimer: CVE-2026-109618 and CVE-2026-109619 are PHP vulnerabilities, not confirmed vulnerabilities in Control Web Panel itself. FreeSpirits modules provide specialized monitoring, auditing, security and optimization capabilities. They do not replace official security patches or guarantee protection against these vulnerabilities.

FreeSpirits Web Services
CWP7 Security | Server Protection | Hosting Solutions
fspirits.com/