PHP Vulnerabilities Exploited in Real-World Attacks: PHP2Shell Confirmed
Credit: AI
Two critical vulnerabilities in PHP are now being exploited successfully in the wild, according to new findings from cybersecurity researchers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute arbitrary code on vulnerable servers without authentication.
The vulnerabilities, collectively associated with the name PHP2Shell, have prompted urgent security warnings as researchers report evidence of successful remote code execution against vulnerable PHP infrastructure.
Successful exploitation confirmed
The latest findings were reported by Adel Karimi, a detection and response researcher at Perplexity, whose honeypot systems recorded attackers successfully executing shell commands on servers running a vulnerable PHP configuration.
According to security researchers, the observed activity involved an Apache mod_php installation running PHP 8.4.26. The findings indicate that the attacks went beyond automated scanning or unsuccessful exploit attempts.
The vulnerabilities affect PHP’s internal memory handling. Under certain conditions, these flaws can expose sensitive memory contents or create an opportunity for remote code execution, potentially giving attackers control over an affected server.
Although successful exploitation has now been demonstrated, the available evidence does not establish that specific production organizations have been compromised.
Which PHP versions are affected?
The PHP security team released fixes on October 21, 2026. The affected versions include releases earlier than the following patched versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Older, unsupported PHP branches may also be vulnerable. Administrators using legacy environments should check whether their operating system vendor provides security updates or plan a migration to a supported release.
Because PHP is widely used to power websites, content management systems and server-side applications, vulnerable installations can create risks across a broad range of online services.
What should website owners do?
Security teams should treat these vulnerabilities as a priority, particularly when PHP applications are exposed directly to the internet.
Recommended steps include updating PHP to a fixed release, checking hosting environments and third-party software for vulnerable components, and reviewing server logs for suspicious requests or unexpected process execution.
Organizations should also investigate unusual PHP worker crashes, unexpected shell commands and signs of unauthorized access. Applying a patch reduces exposure, but it does not establish whether a system was previously compromised.
A separate vulnerability, CVE-2026-115560, was also disclosed in October. It involves a specific combination of PHP configuration and application behavior, so administrators should review the PHP team’s additional mitigation guidance.
A critical reminder for developers
The confirmed PHP2Shell exploitation highlights how quickly a serious software vulnerability can move from public disclosure to practical attacks.
For website operators, the immediate priority is to identify affected systems, apply the appropriate security updates and investigate suspicious activity. Leaving internet-facing PHP installations unpatched could expose critical services and sensitive data to unnecessary risk.
