PHP2Shell RCE Flaws Confirmed Exploited in the Wild
Summary
Researchers confirmed PHP2Shell exploitation against an Apache mod_php installation running PHP 8.4.26, with honeypot evidence of remote code execution. PHP patched the flaws on October 21; a separate unpatched PHP RCE flaw has a mitigation.
Key points
- Adel Karimi's honeypots recorded confirmed remote code execution against Apache mod_php running PHP 8.4.26; Marcus Hutchins also confirmed the findings.
- Evidence included an 800 KiB decoded cookie dump and a function address used in the subsequent execution payload.
- The PHP security team patched PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 on October 21, 2026.
- Earlier exploitation attempts detected by multiple security companies and Amazon Threat Intelligence had been assessed as unsuccessful.
- A separate unpatched PHP RCE, CVE-2026-115560, reportedly requires an unusual combination of configuration and application code; PHP developers advised setting session.upload_progress.enabled=0 as a mitigation.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Memory disclosure
- Severity
- Critical for CVE-2026-109618 and CVE-2026-109619; severity not stated for CVE-2026-115560.
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- For CVE-2026-115560, set session.upload_progress.enabled=0; the PHP developers said this blocks potential attacks.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers successfully exploited the PHP2Shell RCE vulnerabilities against an Apache mod_php installation running PHP 8.4.26.T1595 · Active ScanningDataminr's TRACE team reported that earlier activity against PHP2Shell included scanning and fingerprinting, alongside non-working exploit attempts.
CVE
CVE-2026-109618Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.CVE-2026-109619Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.CVE-2026-115560the PHP security team also shared mitigation measures for a new RCE vulnerability (tracked as CVE-2026-115560) that has no patch and can only be exploited when targeting systems "with an unusual combination of
People
Products
Apache mod_phpThe malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.PHPThe malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26.