GoKawiilPHP2Shell vulnerabilities confirmed exploited in the wild after patch release
Researchers have confirmed the first successful real-world exploitation of PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Perplexity's Adel Karimi documented honeypot evidence showing confirmed RCE with memory disclosure against an Apache mod_php server running PHP 8.4.26, a finding corroborated by Expel's Marcus Hutchins. The PHP security team patched the flaws on October 21, after earlier leaks and unconfirmed exploitation attempts detected by several security firms.