PHP2Shell security flaws now sucessfully exploited in the wild

Researchers have confirmed that the two critical remote-code-execution flaws nicknamed PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, are now being actively and successfully exploited. Adel Karimi, a detection and response lead at Perplexity, captured honeypot traffic showing a complete attack chain against an Apache deployment using mod_php on PHP 8.4.26, including memory leakage and a shell command executed roughly 1.6 milliseconds after the request. Security researcher Marcus Hutchins of Expel independently validated the findings, calling it the most convincing evidence yet of real-world PHP2Shell abuse. The PHP team had already issued emergency fixes on October 21, but leaked advisory details and early non-functional proof-of-concept code preceded the patch; separately, PHP maintainers have now published mitigation guidance for an unrelated, still-unpatched RCE issue, CVE-2026-115560, advising admins to disable session.upload_progress.enabled as a stopgap. Given that PHP powers a large majority of websites worldwide, unpatched servers remain at significant risk.