PHP2Shell RCE flaws confirmed exploited against PHP 8.4.26
Original title: PHP2Shell security flaws now sucessfully exploited in the wild
A Perplexity honeypot saw working RCE and an 800 KiB cookie dump on Apache mod_php; a separate unpatched RCE still needs a config workaround.
CVE-2026-109618 and CVE-2026-109619, tracked as PHP2Shell, were confirmed exploited against an Apache mod_php host running PHP 8.4.26. Adel Karimi of Perplexity reported usable memory disclosure and a shell command about 1.6 ms after the request; Marcus Hutchins of Expel called it the strongest in-the-wild confirmation so far. The PHP team patched the pair on October 21. Earlier PoCs and scanning were described as non-functional or unsuccessful. A newer RCE, CVE-2026-115560, has no patch; admins are told to set session.upload_progress.enabled=0.
Unconfirmed: Earlier company reports of PHP2Shell hits were scanning or non-working exploits; this honeypot case is the first detailed successful RCE confirmation cited.
- Honeypot response included an 800 KiB decoded cookie dump used to build the next payload.
- PHP asked admins on October 20 to prepare, then shipped patches on October 21.
- Amazon saw targeting four days before patches; Dataminr had seen no known compromises until this report.
- CVE-2026-115560 needs an unusual config plus application code and is unpatched.
- VirusTotal estimates cited more than 5.1 million PHP hosts exposed online.
Impact: Remote code execution and memory disclosure on PHP hosts
| Product | Affected |
|---|---|
| PHP | 8.4.26 observed on the exploited honeypot |
| PHP | CVE-2026-115560 when unusual session config is present |
- 1.Install the October 21 PHP security updates for CVE-2026-109618 and CVE-2026-109619.
- 2.Set session.upload_progress.enabled=0 until a patch for CVE-2026-115560 is released.
- Vendors
- PHP
- Products
- Apache mod_php
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — |
From the original article
2 min read at bleepingcomputer.com
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.