Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have now been successfully exploited in the wild.
The confirmed activity marks an important escalation from earlier scanning and failed exploit attempts to verified remote code execution (RCE) against a vulnerable PHP environment.
Confirmed PHP2Shell Exploitation in the Wild
Evidence of successful exploitation was captured by honeypots operated by security researcher Adel Karimi, who observed an attack against an Apache mod_php installation running PHP 8.4.26.
The attack chain produced a large memory disclosure and then used address data derived from that leaked memory in a follow-up execution payload, providing strong evidence that the exploit achieved actual code execution rather than merely crashing the target process.
The findings were independently reviewed by other security researchers, who described the evidence as one of the clearest confirmations of successful PHP2Shell exploitation observed so far.
Researchers caution, however, that the demonstrated exploit worked against a favorable single-worker mod_php configuration and does not prove the same reliability across all PHP builds, worker configurations, or applications.
CISA Publishes Detection Rule for PHP2Shell
The U.S. Cybersecurity and Infrastructure Security Agency has released a SIGMA detection rule designed to help defenders identify PHP2Shell exploitation attempts.
At the time of reporting, CISA had not yet added CVE-2026-109618 or CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, despite the newly documented evidence of successful exploitation.
Security teams should therefore treat both vulnerabilities as actively exploitable and prioritize remediation accordingly.
PHP Emergency Patches Released
The PHP security team released emergency fixes for both PHP2Shell vulnerabilities on October 21, 2026, after warning administrators to prepare for immediate patching.
The disclosure process was complicated by leaked vulnerability details and mitigation guidance before the official patches became available.
Proof-of-concept exploit code also appeared publicly ahead of the release, although the PHP security team said the early examples were not functional.
Multiple security companies, including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack, detected exploitation attempts before public disclosure. Those early attacks were generally limited to scanning, fingerprinting, and unsuccessful exploit execution.
The latest honeypot evidence shows that this situation has now changed.
Attackers Targeted PHP Before Patches Were Available
Amazon Threat Intelligence observed attackers probing the PHP2Shell vulnerabilities four days before patches were released, highlighting the risks created by premature disclosure and rapidly weaponized vulnerability research.
Earlier activity was largely unsuccessful, but widespread reconnaissance against PHP infrastructure demonstrated that attackers were actively searching for vulnerable systems before administrators had access to official fixes.
This makes rapid patch deployment especially important for internet-facing PHP servers.
New Unpatched PHP RCE Also Requires Mitigation
Administrators must also account for a separate PHP vulnerability tracked as CVE-2026-115560.
Unlike PHP2Shell, this RCE flaw currently has no security patch and affects systems using a specific combination of PHP configuration and application behavior.
Until a fix becomes available, PHP developers recommend disabling session upload progress with:
session.upload_progress.enabled=0This mitigation was also previously recommended as a temporary defense against PHP2Shell exploitation.
How to Protect PHP Servers
Organizations running PHP should immediately:
- Apply the latest PHP security updates that address CVE-2026-109618 and CVE-2026-109619.
- Review internet-facing Apache and PHP deployments for suspicious requests.
- Deploy CISA’s SIGMA rule and equivalent SIEM or EDR detections.
- Monitor PHP processes for unexpected child processes or shell execution.
- Investigate unusual memory disclosure behavior and malformed requests.
- Restrict unnecessary public exposure of PHP services.
- Apply the recommended mitigation for CVE-2026-115560 until a patch is released.
PHP remains one of the most widely deployed web technologies on the internet, which makes vulnerabilities in the core runtime especially attractive to threat actors. With millions of PHP hosts exposed online, even a moderately reliable RCE exploit can create a significant global attack surface.
Leave a Reply