# CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

> **Open Intelligence Dossier** · First detected: 2026-10-27 13:20 UTC · Category: Business

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Cloudflare Blog | Introducing the Cloudflare PHP Capture the Flag challenge | [Source Link](https://news.google.com/rss/articles/CBMiTEFVX3lxTFBNRHExVkZlUF9rcUptUTFPZkkzNDk4SUwzWGxlWFJFcnNLNzZSWGNHaUNwYm5QMElaTEpLOXZsZmtRTkhjRE5CbG43M2I?oc=5) |
| TechCrunch | US government says hackers are now exploiting critical PHP web bugs | [Source Link](https://news.google.com/rss/articles/CBMipAFBVV95cUxOOVRJaWtwN3M3TmQwandSTmRnLXl2M0ptRS1qSDJUd1J5dEFadGNlaXZVZlJwRld6TlQteHJIRW15LVY1NWQycXNycXFzMG0yTDRwTklKaTBGQUFPaXhVakNHaUNJMC1MY2poV1MtYlJrUHpmVmxkU0tJTUdkTjFLQUpyZ0g0aDlIdUp6VHlyUlEyQVlNRGczRU5oaWJ0cFgwdFNQVg?oc=5) |
| SOC Prime | CVE-2026-115560: Unpatched PHP RCE Vulnerability | [Source Link](https://news.google.com/rss/articles/CBMioAFBVV95cUxPZjJESnI5LVQ2bUV3UFJXY0RNc2NMaHFrVVVmN3lyWEtHTmhOT1NpRnZqT3lXZDY4akVNbUdpa3dNRVUxd2UwYkVQY3hFdWpUZUNEUzZzQmdSbWs4RmJTM2tVanF4TGJLd0VjUkpxc0tsekRiWDJQUWRJc292VFRnVldsc09reUZ0TVFLSTRQeG5ScjJnVnN4UUJDb09rSlpS?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-10-27/cisa-confirms-active-exploitation-of-two-php2shell-flaws-enabling-remote-code*