PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared. "The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports. "This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said. While the Cybersecurity and Infrastructure Security Agency (CISA) shared a SIGMA detection rule for PHP2Shell RCE exploitation attempts on Friday, the U.S. cybersecurity agency has yet to flag the flaws as exploited in the wild. ​The PHP security team patched the PHP2Shell flaws on Wednesday, October 21, one day after asking admins to prepare to install the security updates as soon as they became available. While details on the PHP2Shell security flaws (including the CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online and some proof-of-concept (PoC) exploits were published before the patches went live, the PHP security team said that none were functional. Additionally, multiple cybersecurity companies (including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack) detected exploitation attempts before public disclosure, but flagged them all as unsuccessful. Security researchers at Amazon Threat Intelligence also spotted attackers targeting the PHP2Shell vulnerabilities four days before security patches were released. However, until Karimi's findings, the malicious activity was "limited to scanning, fingerprinting, and use of …