Researchers confirm PHP2Shell flaws can be used for remote code execution

How the flaw works

According to a SecurityWeek report↗ (opens in a new tab), attackers have moved beyond scanning for PHP2Shell vulnerabilities and have now used them to run shell commands on servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution (RCE). This means an attacker can run any command they choose on a vulnerable server, without needing to log in.

PHP released patches for these vulnerabilities on October 21, after details began circulating online. Before the fix, attackers had already started scanning for systems they could exploit. Millions of these attempts have been recorded, but until now, there was no public confirmation of successful code execution.

How the attack worked

Researcher Adel Karimi from Perplexity set up honeypots, servers designed to attract attackers, to observe real-world exploitation. His honeypots ran PHP 8.4.26 under Apache mod_php with a single worker, simulating a typical web server setup. Initially, Karimi saw only crashes and memory errors, but on October 24, his sensors recorded 35 successful shell launches across three honeypots. One IP address launched three shells on a single honeypot, while another spawned 32 shells across all three.

The attack involved a four-stage sequence of HTTP requests. The first requests exhausted PHP's memory, the next leaked memory contents, and the final step executed a shell command. The traffic matched a public proof-of-concept exploit and showed clear signs of exploiting CVE-2026-109618. No second-stage malware was downloaded during these attacks.

The response

Karimi cautioned that these results only show the exploit working on a specific server setup (single-worker mod_php). He warned that this does not mean the exploit will work as reliably on other PHP builds or configurations. Marcus Hutchins, a principal threat researcher at Expel, called this the strongest confirmation yet of real-world PHP2Shell exploitation.

The US Cybersecurity and Infrastructure Security Agency (CISA) updated its PHP2Shell alert on October 23 to include a detection rule, but as of October 26, it had not added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. CISA said it had not yet seen successful exploitation in the wild.

Is there a fix?

PHP released patches for both vulnerabilities on October 21. Anyone running PHP should update to the latest version as soon as possible to protect their systems. The exploit has now been proven to work in real-world conditions, so unpatched systems are at risk.