Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are being exploited in the wild. Evidence collected from honeypots shows a successful attack against an Apache mod_php installation running PHP 8.4.26, after earlier exploitation attempts had been limited to scanning, fingerprinting and non-functional proof-of-concept exploits.
Researchers confirm successful PHP2Shell exploitation
Adel Karimi, head of Detection and Response at Perplexity, identified the malicious activity. The recorded honeypot evidence and remote code execution analysis document an attack against Apache mod_php running PHP 8.4.26.
“We have confirmed that this is not just a crash following a suspicious process, but an RCE with disclosure of available memory,” Karimi said. “In the response, an 800 KiB decoded cookie dump is delivered, and a function address derived from that dump using the public exploit’s offset appears in the subsequent execution payload.”
Karimi added that the client received a complete response and that the shell command was executed approximately 1.6 milliseconds after the last captured byte of the execution request.
Karimi’s findings were also confirmed by Expel threat researcher Marcus Hutchins, who is tracking multiple reports of successful PHP2Shell exploitation.
“This is the highest quality confirmation of a wild php2shell exploit I’ve ever seen,” Hutchins said. “Deep technical details of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26.”
PHP patches PHP2Shell vulnerabilities
The PHP Security Team patched the PHP2Shell vulnerabilities on Wednesday, October 21, one day after asking administrators to prepare to install the security updates when they became available.
Details about the vulnerabilities, including their CVE identifiers and mitigation advice provided to some critical infrastructure operators, leaked online. Several proof-of-concept exploits were also published before the patch was released, although the PHP Security Team said none of them worked.
Several cybersecurity companies detected exploitation attempts before the vulnerability details were published, including Cloudflare, Emperor Hadrian, watchTowr, Previdian and Patchstack. However, all of those attempts were flagged as unsuccessful.
Amazon Threat Intelligence researchers also discovered an attacker targeting PHP2Shell four days before the security patch was released. According to the Dataminr Threat Research and Cyber Engineering (TRACE) Team, the activity identified before Karimi’s findings was “limited to scanning, fingerprinting, and the use of non-functional exploits, and there were no known breaches.”
PHP discloses another unpatched RCE vulnerability
On Friday, the PHP Security Team also published mitigations for a new remote code execution vulnerability tracked as CVE-2026-115560. The vulnerability remains unpatched and can be exploited only against systems with “unusual combinations of configuration and application code.”
Until a security patch is released, PHP developers have advised administrators to set session.upload_progress.enabled=0 to block potential attacks. This mitigation had already been recommended before the PHP2Shell security update was released.
Millions of PHP hosts remain exposed
PHP, or Hypertext Preprocessor, is a widely used web development language. Recent research from W3Techs indicates that PHP is used by approximately 70% of all websites on the internet. A VirusTotal estimate found that more than 5.1 million PHP hosts are exposed online, with approximately 3.8 million having at least one port exposed to attack.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com