Critical PHP2Shell RCE Flaws Confirmed Exploited in the Wild
Two remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, have been verified as actively exploited, prompting immediate patches and mitigation guidance.
Two critical remote code execution (RCE) vulnerabilities in PHP, catalogued as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, have been confirmed as exploited in real-world attacks. Detection and response lead Adel Karimi at Perplexity reported that honeypot data captured a successful RCE against an Apache mod_php server running PHP 8.4.26, including a decoded 800 KiB cookie dump and subsequent payload execution.
\"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload,\" Karimi said.
\"The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request's final captured byte.\"
Threat researcher Marcus Hutchins of Expel, who has been monitoring PHP2Shell reports, described the findings as the most detailed confirmation of in-the-wild exploitation to date.
\"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26,\" he commented.
The PHP security team released patches for the vulnerabilities on October 21, following an advisory that urged administrators to apply updates promptly. Although proof-of-concept exploits and details about the flaws were leaked before the patches, the team stated that none of the publicly available exploits were functional.
Multiple security firms, including Cloudflare, Hadrian, watchTowr, Previdian and Patchstack, reported detecting exploitation attempts prior to public disclosure, but classified them as unsuccessful. Amazon Threat Intelligence observed scanning and fingerprinting activity four days before the patches, with no confirmed compromises, according to Dataminr's Threat Research and Cyber Engineering (TRACE) team.
In addition to the PHP2Shell fixes, the PHP team disclosed a separate RCE vulnerability, CVE-2026-115560, for which no patch exists yet. Administrators are advised to disable session upload progress by setting session.upload_progress.enabled=0 as a temporary mitigation.