PHP2Shell security flaws now sucessfully exploited in the wild
Two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are now being actively exploited in the wild.
Intelligence analysis by Gemini 2.5 Flash
Security researchers have confirmed successful in-the-wild exploitation of the PHP2Shell flaws, which allow attackers to execute arbitrary code on vulnerable Apache mod_php installations. This confirmation follows earlier reports of scanning and non-working exploits, highlighting a significant escalation in the threat landscape for widely used PHP web servers.
Imagine your favorite website is like a house, and PHP is the special language its builders used to make it work. These PHP2Shell flaws are like secret backdoors that bad guys found in many of these houses. A smart detective named Adel Karimi caught them using one of these backdoors to sneak in, steal cookies (not the yummy kind, but digital ones that hold your info), and even tell the house to do things it shouldn't. Because so many websites use PHP, it's like lots of houses suddenly have these secret backdoors, making it really important for website owners to quickly fix them up.
Analysis
The confirmation of in-the-wild exploitation for the PHP2Shell vulnerabilities marks a significant development in web security. Initially, while proof-of-concept exploits and details leaked, cybersecurity firms like Cloudflare, Hadrian, and Amazon Threat Intelligence had only observed scanning and unsuccessful attempts. The shift to confirmed RCE underscores the persistent efforts of malicious actors to weaponize newly disclosed flaws, especially those impacting widely deployed technologies like PHP.
Adel Karimi
Adel Karimi, a detection and response lead at Perplexity, provided the definitive evidence of successful exploitation. His honeypots captured remote code execution against an Apache mod_php installation running PHP 8.4.26. The technical breakdown included memory disclosure and a decoded cookie dump, followed by a shell command execution, confirming a full compromise rather than just a crash. This detailed observation was crucial in validating the severity and practicality of the PHP2Shell exploits, moving past earlier skepticism about the functionality of leaked PoCs.
Karimi's findings were independently corroborated by Expel threat researcher Marcus Hutchins, who had been monitoring various alleged exploitation reports. Hutchins praised Karimi's analysis as the "highest quality confirmation" seen to date, emphasizing the deep technical insight into the attack chain. This collaborative validation from multiple security experts reinforces the credibility of the threat and the urgency for administrators to apply patches.
PHP Security Team
The PHP security team acted swiftly, releasing emergency patches for the PHP2Shell flaws on Wednesday, October 21, just one day after advising administrators to prepare for updates. This proactive communication and rapid patching effort demonstrate a commitment to mitigating critical vulnerabilities in their widely used language. However, the fact that details and PoCs leaked before patches were universally available created a window of opportunity for attackers, highlighting the challenges of coordinated vulnerability disclosure.
Beyond PHP2Shell, the PHP security team also disclosed mitigation measures for a new, unpatched RCE vulnerability, CVE-2026-115560. This new flaw requires a specific and unusual combination of configuration and application code to be exploitable. Until a patch is released, they recommend setting session.upload_progress.enabled=0 as a preventative measure, a recommendation that was also part of the pre-PHP2Shell patch advice. This indicates a continuous effort to address emerging threats, even as previous ones are being actively exploited.
VirusTotal
According to recent estimates from VirusTotal, PHP is a foundational technology, powering approximately 70% of all websites on the internet. This widespread adoption translates to a massive attack surface, with over 5.1 million PHP hosts exposed online and roughly 3.8 million having at least one port open to potential attacks. The sheer scale of PHP's deployment means that vulnerabilities like PHP2Shell have a far-reaching impact, affecting a significant portion of the global web infrastructure.
The extensive use of PHP underscores why critical RCE flaws are so dangerous; a single vulnerability can expose millions of systems. The data from VirusTotal highlights the persistent challenge of securing such a ubiquitous technology, where even with rapid patching, the long tail of unpatched or misconfigured systems remains a substantial risk. This broad exposure necessitates not only prompt patching but also robust detection and response capabilities for organizations running PHP-based applications.
Key points
- Two critical RCE vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are now being actively exploited.
- Adel Karimi of Perplexity confirmed successful remote code execution against an Apache mod_php installation.
- The PHP security team released emergency patches on October 21, following a warning to administrators.
- Details and proof-of-concept exploits for PHP2Shell leaked online before patches were fully available.
- A new, unpatched RCE vulnerability (CVE-2026-115560) also has mitigation measures shared by the PHP team, requiring specific configurations to exploit.
The rapid detection and confirmation of in-the-wild exploitation by security researchers like Adel Karimi and Marcus Hutchins allowed for swift validation of the threat. The PHP security team also responded quickly by releasing emergency patches, providing administrators with the necessary tools to secure their systems against these critical vulnerabilities.
Despite the availability of patches, the widespread use of PHP means that many systems may remain unpatched for an extended period, leaving them vulnerable to ongoing exploitation. Furthermore, the disclosure of a new, unpatched RCE vulnerability (CVE-2026-115560) indicates a continuous threat landscape, requiring constant vigilance and proactive mitigation from web administrators.
