PHP2Shell Flaws Confirmed Exploited in the Wild

Two critical RCE vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, have been successfully exploited in the wild.

Adel Karimi, detection and response lead at Perplexity, said his honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.

Karimi described the activity as confirmed RCE with usable memory disclosure rather than just a crash, and said the response delivered an 800 KiB decoded cookie dump with a function address from that dump appearing in the subsequent execution payload; he added that the client acknowledged the full response and the shell command ran about 1.6 ms after the execution request's final captured byte.

Expel threat researcher Marcus Hutchins said Karimi's findings were confirmed and called them the highest quality confirmation of in-the-wild PHP2Shell exploitation he had seen so far.

The PHP security team patched the PHP2Shell flaws on Wednesday, October 21, one day after asking admins to prepare to install security updates as soon as they became available. Before the patches went live, details including CVE IDs and mitigation advice for some critical infrastructure providers had leaked online and some proof-of-concept exploits were published, but the PHP security team said none were functional.