US government agencies including CISA and the NSA have urged immediate patching of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions up to 8.5, which enable unauthenticated remote code execution on web servers. Multiple security firms reported exploitation attempts starting October 17, four days before the October 21 emergency patches, with Amazon, Cloudflare, and watchTowr observing broad activity in honeypots and telemetry shortly after disclosure. CISA stated it had not observed exploitation at the time of its alert and has not added the CVEs to its Known Exploited Vulnerabilities catalog as of late October, while some reports note successful shells only on research honeypots. Trader sentiment reflects uncertainty over whether confirmed real-world compromises will trigger an official US government acknowledgment before key resolution deadlines.