![\"PHP\"](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/10\/PHP-headpic.jpg\")
<\/p>\n<\/p>\n
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.<\/p>\n
The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence<\/a> of confirmed remote code execution<\/a> against an Apache mod_php installation running PHP 8.4.26.<\/p>\n “This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit’s offsets appears in the subsequent execution payload,” Karimi shared<\/a>.<\/p>\n “The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,” he added<\/a>.<\/p>\n Karimi’s findings<\/a> were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking<\/a> a stream of alleged successful PHP2Shell exploitation reports.<\/p>\n “This is by far the highest quality confirmation of in-the-wild php2shell exploitation I’ve seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26,” Hutchins said<\/a>.<\/p>\n While the\u00a0Cybersecurity and Infrastructure Security Agency (CISA) shared a SIGMA detection rule<\/a> for PHP2Shell RCE exploitation attempts on Friday<\/a>, the U.S. cybersecurity agency has yet to flag the flaws as exploited in the wild.<\/p>\n \u200bThe PHP security team patched<\/a> the PHP2Shell flaws on Wednesday, October 21, one day after asking admins<\/a> to prepare to install the security updates as soon as they became available.<\/p>\n While details on the PHP2Shell security flaws (including the CVE IDs and mitigation advice provided to some critical infrastructure providers) leaked online<\/a> and some proof-of-concept (PoC) exploits were published before the patches went live, the PHP security team said that none were functional.<\/p>\n Additionally, multiple cybersecurity companies (including Cloudflare<\/a>, Hadrian<\/a>, watchTowr<\/a>, Previdian<\/a>, and Patchstack<\/a>) detected exploitation attempts before public disclosure, but flagged them all as unsuccessful.<\/p>\n Security researchers at Amazon Threat Intelligence also spotted attackers targeting the PHP2Shell vulnerabilities four days before security patches were released<\/a>. However, until Karimi’s findings, the malicious activity was “limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises,” according to Dataminr’s Threat Research and Cyber Engineering (TRACE) team<\/a>.<\/p>\n On Friday, the PHP security team also shared mitigation measures<\/a> for a new RCE vulnerability (tracked as CVE-2026-115560) that has no patch and can only be exploited when targeting systems “with an unusual combination of configuration and application code.”<\/p>\n Until a security patch is released, the PHP devs advised admins to set session.upload_progress.enabled=0 to block potential attacks, a mitigation already recommended before patches for the PHP2Shell security updates were released.<\/p>\n PHP (Hypertext Preprocessor) is a web development language used by roughly 70%<\/a> of all websites on the Internet, with more than 5.1 million PHP hosts exposed online and roughly 3.8 million with at least one port open to attacks, according to recent VirusTotal estimates<\/a>.<\/p>\n<\/a><\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/10\/p-blue-report-26.jpg\")