美国网络安全和基础设施安全局（CISA）已将两个PHP2Shell漏洞列入其“已知被利用漏洞”目录。根据其发布的警报，该局于周一做出这一变更。
The US Cybersecurity and Infrastructure Security Agency (CISA) has put both PHP2Shell flaws in its Known Exploited Vulnerabilities catalogue. It made the change on Monday, according to its alert.
联邦民事机构须在10月29日（周四）之前修复CVE-2026-109618和CVE-2026-109619。
Federal civilian agencies have until Thursday, 29 October, to fix CVE-2026-109618 and CVE-2026-109619.