Technical reports have confirmed that attackers have successfully exploited critical security vulnerabilities known as PHP2Shell (registered under identifiers CVE-2026-109618 and CVE-2026-109619) to execute remote code (RCE) in real-world operating environments.
This confirmation came after malicious activity was detected by Adel Karimi, Head of Detection and Response at Perplexity, where honeypots recorded conclusive evidence of remote code execution against an Apache mod_php installation running PHP version 8.4.26. Karimi explained that the attack was not limited to merely causing system crashes, but also included memory disclosure that allowed attackers to extract data and use it in subsequent execution payloads.
The Evolution of Attacks from Scanning to Compromise
Although many cybersecurity companies, such as Cloudflare and Patchstack, detected exploitation attempts of these vulnerabilities before they were announced, those attempts were classified as unsuccessful or merely scanning and fingerprinting operations. However, Karimi's discovery, which was also confirmed by threat researcher Marcus Hutchins from Expel, represents a dangerous shift from the vulnerability exploration phase to the actual and successful breach phase.
Why Is This News Extremely Dangerous?
The danger lies in the widespread adoption of PHP, as VirusTotal estimates that it powers approximately 70% of all websites on the internet, with over 5.1 million PHP-running hosts exposed to the internet. This means that any vulnerability allowing remote code execution in this language opens the door to large-scale attacks that could target global digital infrastructure.
Warning of a New Vulnerability and Protection Measures
Simultaneously with addressing the PHP2Shell vulnerabilities, the PHP security team warned of a new RCE vulnerability (CVE-2026-115560) that currently has no patch available, targeting systems with non-standard configurations and applications. To protect systems, it is recommended to follow the following procedures:
- Update PHP Immediately: System administrators must install the security updates released by the PHP team on October 21 to address the PHP2Shell vulnerabilities.
- Urgent Preventive Action: To counter the new vulnerability (CVE-2026-115560) which currently lacks a patch, it is recommended to disable the session file upload feature by setting the following configuration in the configuration file: session.upload_progress.enabled=0.