PHP2Shell flaws confirmed exploited in the wild

Two critical remote code execution (RCE) vulnerabilities tracked together as PHP2Shell have been exploited in the wild, according to findings reported by BleepingComputer. The flaws are identified as CVE-2026-109618 and CVE-2026-109619.

Adel Karimi, detection and response lead at Perplexity, found evidence in honeypot data of confirmed remote code execution on an Apache mod_php installation running PHP 8.4.26. Expel threat researcher Marcus Hutchins said Karimi’s findings were the strongest confirmation of PHP2Shell exploitation he had seen.

The PHP security team released patches on Wednesday, October 21, after urging administrators a day earlier to prepare to install the updates. Before the release, researchers and cybersecurity companies had reported scanning, fingerprinting, and attempts using non-working exploits. Dataminr’s Threat Research and Cyber Engineering team said there were no known compromises before Karimi’s findings.

Separately, PHP disclosed a new unpatched RCE vulnerability, CVE-2026-115560. The PHP team said it can be exploited only against systems with an unusual combination of configuration and application code. Until a patch is available, it advised administrators to set session.upload_progress.enabled=0.

VirusTotal estimates cited in the report say PHP is used by roughly 70% of websites, with more than 5.1 million PHP hosts exposed online and about 3.8 million with at least one port open to attacks.