---
title: "PHP2Shell: Real Exploitation of Two Critical PHP Vulnerabilities Confirmed — Attackers Getting Unauthorized Shell Access"
description: "Perplexity and Expel researchers have confirmed successful exploitation of PHP2Shell vulnerabilities (CVE-2026-109618/109619): attackers are gaining remote shell access without authorization. Patches were released on October 21, but attacks are already underway."
date: 2026-10-28T18:39:52.128Z
lang: en
url: https://xab.info/en/posts/php2shell-real-exploitation-critical-php-vulnerabilities-confirmed
tags: [php, vulnerability, cybersecurity, cve-2026-109618, cve-2026-109619, php2shell, remote-code-execution, apache]
author: "Alexander Buran"
publisher: "XAB.info"
---

# PHP2Shell: Real Exploitation of Two Critical PHP Vulnerabilities Confirmed — Attackers Getting Unauthorized Shell Access

![Laptop with source code and a blue PHP elephant plush toy on the keyboard](https://xab.info/media/2026/10/28/php2shell-podtverzhda-uspeshnaya-ekspluatatsiya-kriticheskikh-uyazvimostey-php/php2shell-podtverzhda-uspeshnaya-ekspluatatsiya-kriticheskikh-uyazvimostey-php-1.webp)

## Key Points

- Successful exploitation of two critical PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) allowing unauthorized command execution has been confirmed
- Attack recorded on a server running Apache mod_php and PHP 8.4.26; attacker extracted ~800 KiB of memory and executed a shell command in 1.6 ms
- Patches released by the PHP team on October 21, 2026; initial attack attempts recorded by Amazon Threat Intelligence on October 17
- According to VirusTotal estimates, over 5.1 million PHP hosts are accessible from the internet, with ~3.8 million having an open port

Cybersecurity researchers have confirmed that two critical vulnerabilities in the PHP language, collectively known as PHP2Shell, are now being actively exploited in the wild. These flaws, tracked as CVE-2026-1026-109618 and CVE-2026-109619, allow an attacker to remotely execute arbitrary commands on a vulnerable server without any prior authorization. Until recently, specialists had only recorded attempted attacks without definitive proof that malicious code was actually executing on target systems. The situation changed after independent researchers recorded completed exploitation chains on live servers.

### What the Confirmed Attack Looked Like

The first public confirmation of successful exploitation came from Adel Karimi, Head of Threat Detection and Incident Response at Perplexity. His honeypot servers captured a completed attack against a system running Apache with the mod_php module and PHP version 8.4.26. During the exploitation, the attacker extracted approximately 800 kilobytes of data from process memory, then used the obtained function address to prepare the next phase of the attack. According to Karimi, after sending the last byte of the corresponding HTTP request, the server executed a shell command in about 1.6 milliseconds. Similar results were confirmed by Marcus Hutchins, a researcher at Expel, who was simultaneously tracking reports of successful PHP2Shell exploitation in public channels.

### Timeline: From Exploit Publication to Patching

The PHP development team released patches for both vulnerabilities on October 21, 2026. Prior to this, vulnerability details and several proof-of-concept exploits were already publicly available. At the time, developers emphasized that the published exploit variants did not result in successful code execution. Nevertheless, companies such as Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack reported mass attack attempts that did not culminate in exploitation at the time. Amazon Threat Intelligence specialists recorded the first attempted attacks as early as October 17 — four days before official updates were released. Thus, a vulnerability window existed between the public disclosure and the patch release, during which attackers likely refined working exploits.

### Scope of Potential Damage

PHP remains one of the most widespread server technologies in the world: by various estimates, about 70% of all websites on the internet run on this platform. According to VirusTotal, more than 5.1 million hosts with PHP installed have been discovered in the public domain, with about 3.8 million of them having at least one port open for external scanning and potential attacks. This means that successful PHP2Shell exploitation poses a direct threat to millions of servers that have not been updated to patched versions. For administrators who failed to install the patch before October 21, it is critical to audit access logs and check for signs of unauthorized command execution.

### What Administrators and Developers Should Do

The primary recommendation is to ensure that all servers are updated to PHP versions containing fixes for CVE-2026-109618 and CVE-2026-109619. For systems where updates are not immediately feasible, access to vulnerable ports should be restricted at the firewall level, and the mod_php module should be temporarily disabled unless it is the only way the application functions. In addition, it is recommended to enable enhanced monitoring of web server logs for anomalous requests characteristic of PHP2Shell exploitation and to check file integrity for injected web shells. Researchers remind that the availability of public exploits and confirmed mass exploitation make delaying updates an unacceptable risk.

## Fact-Check & Sources

- [Дыры в PHP начали использоваться в реальных атаках — подтверждены успешные взломы window-new](https://3dnews.ru/1150450/diri-v-php-nachali-ispolzovatsya-v-realnih-atakah-uspeshnie-vzlomi-podtvergdeni) - Primary source. Contains full attack details, researcher names, CVE identifiers, patch dates, and scale estimates.
- [Дыры в PHP начали использоваться в реальных атаках](https://runet.news/news/85521) - Reprint of the 3dnews material retaining all key facts: names, numbers, dates.
- [«Взломы подтверждены»: дыры в PHP начали использоваться в реальных атаках](https://www.topnews.ru/news_id_1320820.html) - Independent retelling with the same facts: 800 KiB, 1.6 ms, PHP 8.4.26, CVE identifiers, patch date October 21.

## FAQ

### What is PHP2Shell and what CVE identifiers correspond to it?

PHP2Shell is the collective name for two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. They allow an attacker to remotely execute arbitrary commands on a server without prior authorization.

### When were the patches released and who released them?

The PHP development team released patches on October 21, 2026. Prior to this, vulnerability details and proof-of-concept exploits were publicly available.

### Who confirmed successful exploitation?

Successful exploitation was confirmed by Adel Karimi (Perplexity) via honeypot servers and Marcus Hutchins (Expel), who tracked reports of successful attacks in public channels.

### How large is the potential threat?

PHP is used on approximately 70% of websites on the internet. According to VirusTotal, over 5.1 million PHP hosts are accessible from the network, with about 3.8 million having at least one open port.

### What should be done if the server is not yet updated?

It is necessary to install the patch as soon as possible, restrict access to vulnerable ports at the firewall level, check web server logs for signs of unauthorized access, and ensure no web shells were injected.