PHP2Shell flaws confirmed exploited in the wild: patch PHP and review exposure

What happened

Two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 and together known as PHP2Shell, have now been exploited successfully in the wild. The activity was captured by Adel Karimi of Perplexity through honeypots, which recorded confirmed code execution against an Apache mod_php installation running PHP 8.4.26. Marcus Hutchins of Expel confirmed the findings.

Karimi noted the evidence comes from a deliberately favourable single-worker mod_php profile. It does not show how reliable the exploit would be on other worker counts, PHP builds or applications.

Background

The PHP security team patched the flaws on 21 October. Details and some proof-of-concept exploits leaked before the patches, though the team said none worked. Several security firms and Amazon Threat Intelligence saw attempts before disclosure, all described as unsuccessful until this confirmation. CISA published a SIGMA detection rule for exploitation attempts, but had not yet listed the flaws as exploited when the source was written.

Separately, the PHP team shared mitigation for another RCE, CVE-2026-115560, which has no patch and is exploitable only with an unusual mix of configuration and application code. Admins are advised to set session.upload_progress.enabled=0 until a fix arrives.

Why it matters

PHP runs on roughly 70% of websites, and VirusTotal estimates more than 5.1 million PHP hosts are exposed online. Institutions should treat internet-facing PHP applications as a priority for patching and review.