PHP2Shell Exploitation Moves From Probes to Working Shells

A security researcher reported that attackers have moved beyond scanning and crash-causing probes to achieving actual remote code execution against the PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. PHP issued fixes for these unauthenticated RCE flaws on October 21 after exploit details leaked, but probing had continued at massive scale without confirmed compromise until Perplexity researcher Adel Karimi's honeypots—running PHP 8.4.26 under Apache mod_php—captured 35 successful shell executions across three sensors on October 24. The intrusion relied on a four-step HTTP request sequence that exhausted memory, exposed its contents, and then ran a shell command, closely mirroring a publicly available exploit and pointing specifically to CVE-2026-109618. Karimi noted his setup used a particularly exploit-friendly single-worker configuration and urged caution about generalizing reliability to other environments, while CISA has not yet added these flaws to its Known Exploited Vulnerabilities catalog despite issuing detection guidance days earlier.