PHP2Shell security flaws now sucessfully exploited in the wild

Key Points:

• Two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, have been successfully exploited in the wild, targeting Apache mod_php installations running PHP 8.4.26.
• The exploits were detected by security researchers including Adel Karimi and Marcus Hutchins, who confirmed the high-quality and functional nature of these attacks, involving memory disclosure and shell command execution.
• The PHP security team released patches for the PHP2Shell vulnerabilities on October 21, following prior warnings to administrators, although some proof-of-concept exploits and leaked details appeared online before the patch release.
• Prior to confirmed exploitation, multiple cybersecurity firms observed scanning and unsuccessful exploitation attempts, and Amazon Threat Intelligence noted targeting activity days before the patches were issued.
• A new unpatched RCE vulnerability (CVE-2026-115560) was also disclosed, with mitigation advice to disable session.upload_progress.enabled until a fix is available, as exploitation requires specific configurations.