JVN updated its information on 28 October regarding the critical PHP vulnerability PHP2Shell. CISA added 2 cases to KEV after confirming exploitation, and information has been reported that FFRI products are also affected.
JVN updated its information at 16:30 on 28 October 2026 regarding CVEs 2026-109618 and 2026-109619, known collectively as PHP2Shell, which are vulnerabilities in PHP that can lead to unauthenticated remote code execution. This update is notable for adding vendor information reported by FFRIセキュリティ stating that affected products exist. It does not concern the discovery of a new vulnerability in PHP itself. On 26 October, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog. In Japan, the Information-technology Promotion Agency (IPA) also added the KEV registration on the same day.
According to FFRIセキュリティ’s official notice, the company is informing customers through its dedicated customer website about the impact on and response for its products of the 2 vulnerabilities published on 21 October. JVN’s “affected products exist” status does not identify specific product names or versions, so customers must check the guidance based on their licensed product information.