Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit’s offsets appears in the subsequent execution payload,” Karimi shared.
“The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request’s final captured byte.”
Karimi’s findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
“This is by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26,” Hutchins said.
The PHP security team patched the PHP2Shell flaws on Wednesday, October 21, one day after asking admins to prepare to install the security updates as soon as they became available.
While details on the PHP2Shell security flaws (including the CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online and some proof-of-concept (PoC) exploits were published before the patches went live, the PHP security team said that none were functional.
Additionally, multiple cybersecurity companies (including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack) detected exploitation attempts before public disclosure, but flagged them all as unsuccessful.
Security researchers at Amazon Threat Intelligence also spotted attackers targeting the PHP2Shell vulnerabilities four days before security patches were released. However, until Karimi’s findings, the malicious activity was “limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises,” according to Dataminr’s Threat Research and Cyber Engineering (TRACE) team.
On Friday, the PHP security team also shared mitigation measures for a new RCE vulnerability (tracked as CVE-2026-115560) that has no patch and can only be exploited when targeting systems “with an unusual combination of configuration and application code.”
Until a security patch is released, the PHP devs advised admins to set session.upload_progress.enabled=0 to block potential attacks, a mitigation already recommended before patches for the PHP2Shell security updates were released.
PHP (Hypertext Preprocessor) is a web development language used by roughly 70% of all websites on the Internet, with more than 5.1 million PHP hosts exposed online and roughly 3.8 million with at least one port open to attacks, according to recent VirusTotal estimates.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
