PHP2Shell security flaws now sucessfully exploited in the wild

PHP2Shell is the name used to track two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. A vulnerability is a weakness that attackers may abuse. These flaws are especially serious because they can enable remote code execution, allowing activity on a vulnerable server without normal local access.

The article reports confirmed exploitation against an Apache mod_php installation running PHP 8.4.26. Adel Karimi’s honeypots recorded memory disclosure and an 800 KiB decoded cookie dump. A function address derived from that dump appeared in a later execution payload, linking the disclosed data to the attack chain.

The PHP security team patched the two flaws on October 21. Earlier proof-of-concept code and leaked details were described as nonfunctional, while several companies saw only unsuccessful attempts. Karimi’s evidence changed that picture by showing usable exploitation in the wild, at least on the tested single-worker setup.

Remote code execution, or RCE, means an attacker can cause a vulnerable computer to run commands or code from a remote location. That crosses a crucial security boundary. The attacker does not need to be physically present on the server, and the commands may run with the permissions available to the affected service.

The article gives a concrete confirmation. A honeypot received an 800 KiB decoded cookie dump after the exploit was used. Researchers then found a function address derived from that dump in the subsequent execution payload. This connected information disclosure to an actual attempt to execute code, not just a crash or suspicious process.

The practical danger depends on the server’s permissions and configuration. RCE can let attackers alter applications, access data, or run further commands. The article confirms the execution chain, but does not report a specific compromise of a production website.

The evidence came from honeypots operated by Adel Karimi, Perplexity’s detection and response lead. They recorded confirmed remote code execution against Apache mod_php running PHP 8.4.26. This was more substantial than earlier reports of scanning, fingerprinting, or failed exploit attempts.

Karimi reported that the response contained an 800 KiB decoded cookie dump. He then observed a function address derived from that dump, using offsets from the public exploit, in the next execution payload. That relationship showed that leaked memory was usable in the attack, helping the exploit progress toward code execution.

Expel researcher Marcus Hutchins independently confirmed the findings and called them the strongest in-the-wild confirmation he had seen. The evidence came from an intentionally favorable single-worker mod_php profile. Karimi cautioned that it does not measure reliability across other worker counts, PHP builds, or applications.

PHP2Shell could affect a large population because PHP is used by roughly 70% of all websites, according to the article. That figure describes PHP’s broad presence, not the number definitely vulnerable to these two flaws. Actual risk depends on the PHP version, configuration, application, and whether updates have been installed.

Recent VirusTotal estimates counted more than 5.1 million PHP hosts exposed online. Roughly 3.8 million had at least one port open to attacks. Those figures show how many PHP-related systems may be reachable, but they do not prove that every host runs an affected build or exposes the vulnerable code path.

The confirmed attack targeted Apache mod_php on PHP 8.4.26, using an intentionally favorable single-worker profile. Karimi warned that this result does not measure other worker counts, PHP builds, or applications. Administrators therefore need to identify their exact deployments rather than assume identical exploitability everywhere.

The main protection is to install the PHP security updates. The PHP security team patched PHP2Shell on October 21 and had already urged administrators to prepare for the updates. Applying the fixes removes the known PHP2Shell weaknesses from supported, updated installations.

Until a patch is available for the separate RCE vulnerability CVE-2026-115560, PHP developers advised administrators to set session.upload_progress.enabled=0. The same mitigation had already been recommended before the PHP2Shell patches were released. It is intended to block potential attacks involving that setting.

Administrators should also treat exposed systems as urgent investigation targets because exploitation has now been confirmed in the wild. The article does not provide a broader hardening checklist. It does caution that CVE-2026-115560 requires an unusual combination of configuration and application code, so its exposure may differ from PHP2Shell.

If attackers exploit PHP2Shell, they may gain the ability to run code remotely through a vulnerable PHP environment. That can turn a web-facing weakness into a broader server security problem. The exact damage depends on the permissions of the PHP process, the application, and the surrounding configuration.

The confirmed activity demonstrates the mechanism’s seriousness. A honeypot running Apache mod_php and PHP 8.4.26 returned an 800 KiB decoded cookie dump. A function address derived from that memory appeared in a later execution payload. This showed that the attacker could use disclosed memory while advancing toward code execution.

Potential outcomes include unauthorized access to application data, changes to website content, or additional commands run by the service account. The article does not report a specific production compromise or list completed attacker actions beyond the observed chain. It does establish that the flaws are no longer merely theoretical or limited to failed scans.

In a typical setup, Apache receives a request for a PHP-powered page. Its mod_php integration passes the PHP work to the PHP interpreter. The web application uses that input to build a response, which Apache sends back to the visitor. The operating system runs Apache and PHP as processes with specific permissions.

The important boundaries are between an outside request and the application, between application data and PHP execution, and between the PHP process and operating-system resources. A vulnerability can let crafted remote input escape its intended role as data and influence PHP’s execution. If that becomes RCE, the attacker can make the server-side process run code.

The article’s confirmed case involved Apache mod_php on PHP 8.4.26. It recorded memory disclosure and a later execution payload. The article does not describe every internal boundary or the exact vulnerable code path. Those operational details are based on the standard PHP and Apache model, while the confirmed attack evidence comes from the article.