PHP2Shell Security Flaws Now Successfully Exploited
The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared.
"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.
"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.
https://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0moreanon&utm_medium=feed at Slashdot.
https://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0mainlinkanon&utm_medium=feed
Slashdot (RSS Feed)
npub1rk…d8w8z
2026-10-26 23:00:00 UTC
Author Public Key
npub1rk3j5fc4ew5w9zd7kx5zfqt04tew0kan9swrr63ctn6k8wp8f65qwd8w8zSeen on
wss://nostr.data.hausPublished at
2026-10-26 23:00:00 UTCEvent JSON
{
"id": "89fd47b400a994368781698617c10aca1550012ff5cc16538e979ac97f7a147f",
"pubkey": "1da32a2715cba8e289beb1a824816faaf2e7dbb32c1c31ea385cf563b8274ea8",
"created_at": 1793055600,
"kind": 1,
"tags": [
[
"t",
"privacy"
],
[
"proxy",
"http://rss.slashdot.org/Slashdot/slashdot#https%3A%2F%2Fyro.slashdot.org%2Fstory%2F26%2F10%2F26%2F2150206%2Fphp2shell-security-flaws-now-successfully-exploited%3Futm_source%3Drss1.0mainlinkanon%26utm_medium%3Dfeed",
"rss"
]
],
"content": "PHP2Shell Security Flaws Now Successfully Exploited\n\nThe critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. \"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload,\" Karimi shared.\n \n\"The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,\" he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports.\n \n\"This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26,\" Hutchins said.\n\nhttps://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0moreanon\u0026utm_medium=feed at Slashdot.\n\nhttps://yro.slashdot.org/story/26/10/26/2150206/php2shell-security-flaws-now-successfully-exploited?utm_source=rss1.0mainlinkanon\u0026utm_medium=feed",
"sig": "5dcd658f710d4ae1c544d1590c597b92072ad882378bfe244de907306aabbf1425502fd202aabdb4740fa9427349d68f20dfeebf65c2773fe2d5657f21a4e8b7"
}