GoKawiilPHP2Shell flaw sees confirmed remote code execution in the wild
Security researchers confirmed successful exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), just days after patches shipped and earlier exploitation attempts had failed. Adel Karimi of Perplexity reported honeypot evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26, including an 800 KiB decoded cookie dump and a function address matching a public exploit's offsets appearing in the execution payload. Expel researcher Marcus Hutchins corroborated the finding, calling it the highest-quality confirmation of in-the-wild exploitation seen so far.
GoKawiil's interpretation of the reporting above, not reported fact.
Confirmed working exploits typically accelerate broader attacker adoption, especially once patches are public and technical details circulate. Karimi cautioned that his evidence applies only to a specific single-worker mod_php configuration, so the exploit's reliability across other server setups remains unproven. Still, the combination of patch availability and now-verified RCE raises urgency for unpatched PHP deployments to update quickly.
- CVE-2026-109618 and CVE-2026-109619 have moved from suspected to confirmed remote code execution in the wild.
- Evidence came from honeypot data showing memory disclosure and exploit-derived function addresses in attack payloads.
- The confirmed exploit chain was demonstrated only on a specific single-worker mod_php/PHP 8.4.26 setup, not proven broadly reliable.
YubiKey 5C NFC Security Key — With RCE exploits against server stacks now being actively weaponized, hardening access controls on your infrastructure accounts matters more than ever. A hardware security key like the YubiKey 5C NFC adds a strong second factor to admin logins, making it much harder for attackers who gain initial footholds to pivot into your critical systems.》
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: yro.slashdot.org, 2026-10-26
Published there as: “PHP2Shell Security Flaws Now Successfully Exploited”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.