Cybersecurity researchers have confirmed that two critical vulnerabilities in the PHP language, collectively known as PHP2Shell, are now being actively exploited in the wild. These flaws, tracked as CVE-2026-1026-109618 and CVE-2026-109619, allow an attacker to remotely execute arbitrary commands on a vulnerable server without any prior authorization. Until recently, specialists had only recorded attempted attacks without definitive proof that malicious code was actually executing on target systems. The situation changed after independent researchers recorded completed exploitation chains on live servers.
What the Confirmed Attack Looked Like
The first public confirmation of successful exploitation came from Adel Karimi, Head of Threat Detection and Incident Response at Perplexity. His honeypot servers captured a completed attack against a system running Apache with the mod_php module and PHP version 8.4.26. During the exploitation, the attacker extracted approximately 800 kilobytes of data from process memory, then used the obtained function address to prepare the next phase of the attack. According to Karimi, after sending the last byte of the corresponding HTTP request, the server executed a shell command in about 1.6 milliseconds. Similar results were confirmed by Marcus Hutchins, a researcher at Expel, who was simultaneously tracking reports of successful PHP2Shell exploitation in public channels.
Timeline: From Exploit Publication to Patching
The PHP development team released patches for both vulnerabilities on October 21, 2026. Prior to this, vulnerability details and several proof-of-concept exploits were already publicly available. At the time, developers emphasized that the published exploit variants did not result in successful code execution. Nevertheless, companies such as Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack reported mass attack attempts that did not culminate in exploitation at the time. Amazon Threat Intelligence specialists recorded the first attempted attacks as early as October 17 — four days before official updates were released. Thus, a vulnerability window existed between the public disclosure and the patch release, during which attackers likely refined working exploits.
Scope of Potential Damage
PHP remains one of the most widespread server technologies in the world: by various estimates, about 70% of all websites on the internet run on this platform. According to VirusTotal, more than 5.1 million hosts with PHP installed have been discovered in the public domain, with about 3.8 million of them having at least one port open for external scanning and potential attacks. This means that successful PHP2Shell exploitation poses a direct threat to millions of servers that have not been updated to patched versions. For administrators who failed to install the patch before October 21, it is critical to audit access logs and check for signs of unauthorized command execution.
What Administrators and Developers Should Do
The primary recommendation is to ensure that all servers are updated to PHP versions containing fixes for CVE-2026-109618 and CVE-2026-109619. For systems where updates are not immediately feasible, access to vulnerable ports should be restricted at the firewall level, and the mod_php module should be temporarily disabled unless it is the only way the application functions. In addition, it is recommended to enable enhanced monitoring of web server logs for anomalous requests characteristic of PHP2Shell exploitation and to check file integrity for injected web shells. Researchers remind that the availability of public exploits and confirmed mass exploitation make delaying updates an unacceptable risk.
