GoKawiilPHP2Shell vulnerabilities confirmed exploited in the wild after patch release
Researchers have confirmed the first successful real-world exploitation of PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Perplexity's Adel Karimi documented honeypot evidence showing confirmed RCE with memory disclosure against an Apache mod_php server running PHP 8.4.26, a finding corroborated by Expel's Marcus Hutchins. The PHP security team patched the flaws on October 21, after earlier leaks and unconfirmed exploitation attempts detected by several security firms.
GoKawiil's interpretation of the reporting above, not reported fact.
The confirmed exploitation marks an escalation from earlier reports of failed or inconclusive attacks, suggesting threat actors have now developed working tools based on leaked technical details or public proof-of-concept code. This could pressure organizations running Apache mod_php on affected PHP versions to patch urgently, since unpatched systems may now face real attacks rather than theoretical risk.
- PHP2Shell flaws (CVE-2026-109618/109619) have moved from theoretical risk to confirmed real-world exploitation.
- The attack achieved remote code execution with memory disclosure against an Apache mod_php server running PHP 8.4.26.
- Multiple security firms had earlier spotted attempted exploitation before the October 21 patch, but Karimi's data is described as the clearest evidence of success so far.
Source: bleepingcomputer.com, 2026-10-26
Published there as: “PHP2Shell security flaws now sucessfully exploited in the wild”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.