PHP2Shell security flaws now successfully exploited in the wild
Two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have now been confirmed as successfully exploited in the wild. Adel Karimi, detection and response lead at Perplexity, captured evidence of successful exploitation against an Apache mod_php installation running PHP 8.4.26, including memory disclosure and subsequent command execution. The findings, corroborated by security researcher Marcus Hutchins, mark a significant escalation from earlier reports of scanning and unsuccessful exploitation attempts.
Seeing some anecdotal reports of successful php2shell exploitation in the wild, but also seeing a lot of people mistaking old exploits for php2shell. I'd say it's fairly likely there's at least some exploitation going on, but all the people I'd usually confer with for a second…
Bri Frost, Director of Product Management, Cloud Range said this:
“PHP2Shell highlights a challenge that security teams increasingly face: exploitation can begin before defenders have complete information about a vulnerability, its impact or even whether available mitigations are effective. In these situations, the biggest risk isn’t necessarily a lack of security tools. It’s whether the people responsible for responding can make the right decisions quickly under pressure.
“Organizations should be testing how their security teams respond when a critical vulnerability moves from theoretical risk to active exploitation. Can analysts distinguish scanning from successful compromise? Can they identify suspicious activity on affected servers, determine whether attackers have established persistence and coordinate containment without unnecessarily disrupting business operations? These are skills that need to be developed through realistic exercises, not figured out during an actual incident. The faster exploitation timelines become, the more important it is that security teams have already practiced responding to situations where the threat is evolving faster than the available intelligence.”
If you haven’t fixed or replaced any application that uses PHP, now is a really good time to do so. Though based on this, it might be too late already.
This entry was posted on October 26, 2026 at 4:13 pm and is filed under Commentary with tags PHP. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
PHP2Shell security flaws now successfully exploited in the wild
Two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have now been confirmed as successfully exploited in the wild. Adel Karimi, detection and response lead at Perplexity, captured evidence of successful exploitation against an Apache mod_php installation running PHP 8.4.26, including memory disclosure and subsequent command execution. The findings, corroborated by security researcher Marcus Hutchins, mark a significant escalation from earlier reports of scanning and unsuccessful exploitation attempts.
Bri Frost, Director of Product Management, Cloud Range said this:
“PHP2Shell highlights a challenge that security teams increasingly face: exploitation can begin before defenders have complete information about a vulnerability, its impact or even whether available mitigations are effective. In these situations, the biggest risk isn’t necessarily a lack of security tools. It’s whether the people responsible for responding can make the right decisions quickly under pressure.
“Organizations should be testing how their security teams respond when a critical vulnerability moves from theoretical risk to active exploitation. Can analysts distinguish scanning from successful compromise? Can they identify suspicious activity on affected servers, determine whether attackers have established persistence and coordinate containment without unnecessarily disrupting business operations? These are skills that need to be developed through realistic exercises, not figured out during an actual incident. The faster exploitation timelines become, the more important it is that security teams have already practiced responding to situations where the threat is evolving faster than the available intelligence.”
If you haven’t fixed or replaced any application that uses PHP, now is a really good time to do so. Though based on this, it might be too late already.
Share this:
Like this:
Related
This entry was posted on October 26, 2026 at 4:13 pm and is filed under Commentary with tags PHP. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.