Critical PHP2Shell RCE Flaws Confirmed Exploited in the Wild Against Apache mod_php

Two critical remote code execution (RCE) vulnerabilities in PHP — tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell — are now being actively exploited in the wild, security researchers confirmed Monday.

The confirmed exploitation was captured on honeypots operated by Adel Karimi, detection and response lead at Perplexity, which recorded remote code execution against an Apache mod_php installation running PHP 8.4.26.

Memory Disclosure Followed by Rapid Shell Execution

According to Karimi's technical breakdown, the captured attack chained a memory disclosure response directly into code execution rather than merely crashing the worker process.

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.

"The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request's final captured byte," Karimi added.

Karimi's evidence was independently reviewed and confirmed by Expel threat researcher Marcus Hutchins, who had been evaluating earlier reports of attempted PHP2Shell exploitation.

"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.

Patch Timeline and Unpatched CVE-2026-115560 Mitigation

The PHP security team released patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday, Oct. 21, one day after advising system administrators to prepare for emergency updates.

Prior to Karimi's honeypot capture, Amazon Threat Intelligence had observed attackers probing for the PHP2Shell flaws four days before the Oct. 21 patches were published, and security firms including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack had logged pre-disclosure exploitation attempts. However, Dataminr's Threat Research and Cyber Engineering (TRACE) team noted that earlier activity had been limited to scanning, fingerprinting, and non-functional proof-of-concept exploits.

Separately on Friday, the PHP security team issued mitigation guidance for an additional unpatched RCE vulnerability tracked as CVE-2026-115560, which the team said can only be exploited on systems with "an unusual combination of configuration and application code." Until a patch is available, PHP developers advised administrators to set session.upload_progress.enabled=0 — a configuration setting that had also been recommended as a pre-patch mitigation for PHP2Shell.

According to VirusTotal estimates cited by BleepingComputer, PHP is used by roughly 70% of websites on the internet, with more than 5.1 million PHP hosts exposed online and approximately 3.8 million having at least one port open to external connections.