Overview
Two critical remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619 and collectively tracked as PHP2Shell, have now been successfully exploited in the wild. Earlier reports had described only scanning and exploit attempts that did not work.
Researcher Adel Karimi of Perplexity recorded in-the-wild RCE in honeypots against an Apache mod_php installation running PHP 8.4.26. The response contained an 800 KiB decoded cookie dump, and a function address from it appeared in a later payload. Expel's Marcus Hutchins also confirmed the findings.
Karimi cautioned that the evidence reflects a "favorable single-worker mod_php profile" and does not show that the exploit is reliable in every setup.
Exposure
PHP runs on roughly 70% of websites. VirusTotal estimates more than 5.1 million exposed PHP hosts, about 3.8 million of which have at least one port open to attack. CISA has shared a SIGMA detection rule but had not yet added the flaws to its Known Exploited Vulnerabilities catalog.
Patch and Mitigation
- Apply the PHP security releases published on October 21, 2026. Check your distribution's package changelog for the exact fixed versions.
- A separate flaw, CVE-2026-115560, was still unpatched at the time of reporting. It only affects systems with an unusual combination of configuration and application code. Until a fix ships, PHP's developers advise setting
session.upload_progress.enabled=0. - Use the CISA-provided SIGMA rule to hunt for exploitation attempts in web server logs.
- Review hosts running mod_php first, since that is where working exploitation was observed.
For earlier details, see our coverage of the emergency PHP patches and the unpatched CVE-2026-115560 risk.