PHP2Shell Security Flaws Now Successfully Exploited
The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.
"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.
https://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0moreanon&utm_medium=feed at Slashdot.
https://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0mainlinkanon&utm_medium=feed
Slashdot (RSS Feed)
npub1y0…9f73e
2026-10-26 23:00:00 UTC
Author Public Key
npub1y0k2ql292ykh944azk2yvvj0umklpjnyxkfht4j5zlw56snc228s29f73eSeen on
wss://nostr.data.hausPublished at
2026-10-26 23:00:00 UTCEvent JSON
{
"id": "d39943b60a6d061b9b3ea65d56de7e0436bbc002d87c343422af259b7c83146b",
"pubkey": "23eca07d45512d72d6bd159446324fe6edf0ca64359375d65417dd4d4278528f",
"created_at": 1793055600,
"kind": 1,
"tags": [
[
"t",
"privacy"
],
[
"proxy",
"http://rss.slashdot.org/Slashdot/slashdotMain#https%3A%2F%2Fyro.slashdot.org%2Fstory%2F26%2F10%2F26%2F2150206%2Fphp2shell-security-flaws-now-successfully-exploited%3Futm_source%3Drss1.0mainlinkanon%26utm_medium%3Dfeed",
"rss"
]
],
"content": "PHP2Shell Security Flaws Now Successfully Exploited\n\nThe critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. \"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload,\" Karimi shared.\n \n\"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,\" he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.\n \n\"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26,\" Hutchins said.\n\nhttps://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0moreanon\u0026utm_medium=feed at Slashdot.\n\nhttps://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0mainlinkanon\u0026utm_medium=feed",
"sig": "18174571d74361ad9fd9e7d61504288d7dd95bef04d2747a67fe4969eff5de1131dad18f7bd0559de7af7269ae23273960a48bb00f684c070a39a697bac88416"
}