US government agencies including the NSA and CISA have urged immediate patching of the PHP2Shell remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP 5.4–8.5, citing unauthenticated attacks that bypass application code via memory corruption and stale session state in mod_php environments. Amazon Threat Intelligence logged the first probes on October 17, four days before the October 21 emergency releases, while Cloudflare recorded thousands of attempts pre-disclosure escalating to millions afterward; however, CISA has not yet added the CVEs to its Known Exploited Vulnerabilities catalog or confirmed successful breaches in production systems. Trader sentiment hinges on whether these attempts translate to documented compromises before the October 31 deadline, with upcoming catalysts including any CISA KEV update, agency statements on real-world impact, or further honeypot telemetry distinguishing probes from working exploits.