Researcher Confirms PHP2Shell Vulnerability Has Been Exploited in Real-World Attacks

A critical cybersecurity threat known as PHP2Shell has escalated after researchers reported evidence that attackers successfully exploited vulnerabilities in real-world environments. The issue involves two serious flaws in PHP, a widely used server-side programming language that powers websites and web applications. Identified as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities can potentially allow unauthenticated attackers to execute malicious code remotely on affected systems. This means an attacker may be able to compromise a vulnerable server without first obtaining a legitimate user account. On October 26, 2026, BleepingComputer reported that Adel Karimi, a detection and response lead at Perplexity, had captured evidence of successful exploitation through a honeypot designed to monitor malicious activity. The report has intensified concerns because the threat appears to have moved beyond theoretical vulnerability research into actual attacks.

The PHP2Shell vulnerabilities arise from problems in how PHP manages memory and handles certain internal operations. One flaw involves out-of-memory conditions that can leave internal data in an unsafe state, while the other involves stale references to memory that has already been released. Under certain conditions, attackers can exploit these weaknesses to disclose sensitive memory contents or achieve remote code execution. Successful exploitation could give criminals a pathway to interfere with applications, access information processed by a server or run unauthorised commands. The PHP security team assigned both vulnerabilities a CVSS v4.0 severity score of 9.2 out of 10, placing them in the critical category. Researchers have also demonstrated potential attack paths involving widely used platforms and frameworks, including WordPress, Drupal, Joomla and other PHP-based applications. However, exposure depends on the PHP version, server configuration and, for some attack paths, application-specific conditions.

The reported real-world incident attracted attention because the researcher described evidence consistent with successful code execution rather than merely an unsuccessful attack attempt or a server crash. According to BleepingComputer’s October 26 report, the monitored Apache server was running PHP 8.4.26, a version that had not received the relevant security fixes. The captured activity reportedly included the disclosure of approximately 800 kilobytes of decoded cookie data, followed by a payload associated with the execution of a shell command. Expel threat researcher Marcus Hutchins also reportedly assessed the evidence as a strong confirmation of successful exploitation. Nevertheless, cybersecurity monitoring results have not been identical across all organisations. In an October 27 update, Wiz said its own telemetry had not identified a successful end-to-end PHP2Shell exploit, while acknowledging the evidence reported by Karimi. This distinction matters: the available findings support serious concern about exploitation, but they do not establish that every vulnerable PHP server has been compromised or that every attempted attack succeeds.

In response to the threat, the PHP security team released patched versions on October 21, 2026. Administrators using supported PHP branches should upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later fixed release in the relevant branch. Older versions, including PHP 8.1 and earlier, are also affected, and many no longer receive official security updates. Organisations running outdated software may therefore need to migrate to a supported version rather than rely on an ordinary upgrade. Security agencies are advising administrators to identify all internet-facing PHP installations, including those supporting third-party applications, apply the appropriate patches and review server logs for suspicious activity. Where immediate patching is impossible, organisations should assess their exposure and consider temporarily taking vulnerable systems offline. Installing a security update is essential, but systems suspected of compromise also require investigation because patching alone does not remove an attacker who may already have gained access.

The PHP2Shell incident highlights the security challenges created by software that underpins a large portion of the modern internet. Because PHP is used across websites, content-management systems and business applications, vulnerabilities in the language itself can affect organisations of many different sizes. The incident also demonstrates why security teams must act quickly when critical patches become available: once technical details and proof-of-concept research become public, attackers can study the weaknesses and search for systems that remain unprotected. Website owners, hosting providers, developers and IT administrators should verify their PHP versions, install the relevant fixes, investigate unusual server activity and strengthen their monitoring procedures. For businesses that depend on online services, delaying updates could increase the risk of data exposure, service disruption and unauthorised access. As researchers continue monitoring PHP2Shell activity, rapid remediation and careful incident response remain the most important steps for reducing the threat.