PHP2Shell flaws confirmed exploited in the wild for the first time

Two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619), collectively dubbed PHP2Shell, are now confirmed to be exploited in real attacks.

The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded confirmed code execution against an Apache mod_php setup running PHP 8.4.26.

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi wrote. "The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload. The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request's final captured byte."

Karimi's findings were confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell reports. He called it by far the highest-quality confirmation of in-the-wild exploitation he has seen.

The patch came a week earlier

The PHP security team patched the flaws on Wednesday, October 21 — one day after asking admins to prepare for an urgent update. Details (including the CVE IDs and mitigation advice sent to some critical infrastructure providers) and several PoC exploits leaked online before the patches shipped, but the PHP team said none of them worked.

Multiple firms — Cloudflare, Hadrian, watchTowr, Previdian and Patchstack — spotted exploitation attempts before public disclosure, yet all were unsuccessful. Amazon Threat Intelligence saw attackers probing four days before the patches dropped, but until Karimi's discovery the activity was, per Dataminr's TRACE team, limited to scanning, fingerprinting and non-working exploits, with no known compromises.

On Friday the PHP team also shared mitigations for a new RCE flaw (CVE-2026-115560) that has no patch and can only be triggered given an "unusual combination of configuration and application code." Until a fix ships, admins are advised to set session.upload_progress.enabled=0.

PHP powers roughly 70% of all websites on the internet; VirusTotal estimates more than 5.1 million PHP hosts are exposed online, with about 3.8 million having at least one port open to attack.

Source: Bleeping Computer