Two critical remote code execution vulnerabilities in PHP, tracked together as PHP2Shell, have been exploited successfully in real-world attacks, with honeypots confirming an actual compromise rather than mere scanning. The flaws are identified as CVE-2026-109618 and CVE-2026-109619. The confirmed exploitation hit an Apache mod_php installation running PHP 8.4.26.
Adel Karimi, detection and response lead at Perplexity, recorded the evidence on honeypots. According to Karimi, the targeted client acknowledged the complete response and the shell command executed roughly 1.6 ms after the final captured byte of the execution request. The finding was corroborated by Expel threat researcher Marcus Hutchins, who has been monitoring a series of claimed PHP2Shell exploitation reports. Hutchins described Karimi's work as the strongest confirmation of in-the-wild PHP2Shell exploitation he has seen, calling it a deep technical breakdown of a successful attempt against an Apache mod_php installation running PHP 8.4.26.
The PHP security team patched the PHP2Shell flaws on Wednesday, October 21, one day after telling administrators to be ready to install the updates as soon as they shipped. Before the patches were available, details about the flaws leaked online, including the CVE identifiers and mitigation guidance given to some critical infrastructure providers, and some proof-of-concept exploits were published. The PHP security team said none of those exploits were functional.
Several cybersecurity companies, among them Cloudflare, Hadrian, watchTowr, Previdian and Patchstack, had detected exploitation attempts before public disclosure but classified all of them as unsuccessful. Amazon Threat Intelligence researchers also observed attackers targeting the PHP2Shell vulnerabilities four days before the patches were released. According to Dataminr's Threat Research and Cyber Engineering (TRACE) team, that earlier activity was confined to scanning, fingerprinting and non-working exploits, with no known compromises until Karimi's confirmation.
Separately, the PHP security team on Friday published mitigations for a new RCE vulnerability tracked as CVE-2026-115560. No patch exists for it, and it can only be exploited against systems with an unusual combination of configuration and application code. Until a fix is ready, the PHP developers advised administrators to set session.upload_progress.enabled=0, the same mitigation recommended before the PHP2Shell patches landed.
PHP, short for Hypertext Preprocessor, is a web development language used by roughly 70% of websites. Recent VirusTotal estimates put more than 5.1 million PHP hosts online, with about 3.8 million having at least one port open to attack. The confirmed exploitation matters for that population because prevention scores can mask what happens after initial access, and once attackers hold valid credentials, prevention rates fall sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
More cybersecurity news from TechManNews.
