PHP2Shell Flaws Successfully Exploited in the Wild
Two critical remote code execution vulnerabilities collectively tracked as PHP2Shell have moved past non-functional scanning into confirmed in-the-wild exploitation.
Radwan AbdulhadiEditor and technology writer
Confirmed In-The-Wild Exploitation
Two critical remote code execution vulnerabilities, collectively tracked as PHP2Shell and designated as CVE-2026-109618 and CVE-2026-109619, have now been successfully exploited in the wild according to recent researcher findings. The malicious activity was initially caught by Adel Karimi, who serves as the detection and response lead at Perplexity, via honeypots that recorded confirmed remote code execution targeting an Apache mod_php installation running PHP 8.4.26.
According to details shared by Karimi, the successful exploitation delivered usable memory disclosure rather than just a process crash or suspicious behavior. The response delivered an 800 KiB decoded cookie dump along with a derived function address used in the subsequent execution payload. The client acknowledged the full response while the shell command ran approximately 1.6 milliseconds after the final captured byte of the execution request.
Researcher Validation and Prior Activity
The technical breakdown and evidence were subsequently reviewed by Expel threat researcher Marcus Hutchins, who has been tracking a continuous stream of reports regarding the PHP2Shell flaws. Hutchins noted that this instance represents the highest quality confirmation of in-the-wild exploitation seen to date against the specified Apache mod_php environment.
Prior to these confirmed episodes, security researchers at Amazon Threat Intelligence had already spotted threat actors targeting the PHP2Shell vulnerabilities four days before security updates were published. Additional cybersecurity firms such as Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack also detected preliminary scanning attempts before public disclosure, though those earlier efforts were flagged as unsuccessful.
Patch Timeline and Leaks
The PHP security team officially patched the critical PHP2Shell vulnerabilities on Wednesday, October 21. This followed an earlier warning sent to administrators to prepare for the deployment of emergency security updates as soon as they became available. Technical details and proof-of-concept exploits had previously leaked online prior to the official patch release, though developers maintained that those initial variants were non-functional.
In addition to the PHP2Shell fixes, the PHP security team shared mitigation steps for a separate remote code execution vulnerability tracked as CVE-2026-115560, which currently lacks a direct patch. Administrators have been advised to set session.upload_progress.enabled=0 to block potential attacks involving specific configuration and application code combinations until a permanent update is ready.
Scope and Impact on Ecosystem
Hypertext Preprocessor (PHP) remains a foundational web development language utilized across a vast portion of internet infrastructure. Recent estimates from VirusTotal indicate that roughly 70% of all websites rely on PHP, with over 5.1 million PHP hosts exposed online and approximately 3.8 million maintaining at least one open port vulnerable to potential attacks.
Sources
- BleepingComputerPHP2Shell security flaws now sucessfully exploited in the wild
Continue chronologically
Related entity coverage
Related stories
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
PHP Shares Mitigation for New Unpatched RCE Vulnerability
The PHP security team shares mitigation measures for a new remote code execution vulnerability affecting non-default configurations without a current patch.
Cloudflare Launches PHP Capture the Flag Challenge on HackerOne
Cloudflare has introduced a PHP Capture the Flag challenge integrated with its Bug Bounty program to test WAF protections against recent vulnerabilities.
Amazon: PHP2Shell Exploitation Began Days Before Patches
Amazon Threat Intelligence reveals that threat actors began targeting critical PHP2Shell vulnerabilities four days before emergency patches were released.
