PHP2Shell Flaws Exploited in Wild Despite Patches

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Adel Karimi, detection and response lead at Perplexity, said.

Perplexity honeypots: confirmed remote code execution against Apache mod_php

Karimi's honeypots recorded what he described as confirmed remote code execution (RCE) against an Apache mod_php installation running PHP 8.4.26. The telemetry included an 800 KiB decoded cookie dump and a subsequent payload containing a function address calculated from that dump using a public exploit's offsets. According to Karimi, the client acknowledged the full response and the shell command executed about 1.6 ms after the final captured byte of the execution request.

Independent confirmation and vendor sightings

Expel threat researcher Marcus Hutchins corroborated Karimi's observations, calling the data "by far the highest quality confirmation of in-the-wild php2shell exploitation" he had seen and describing a "deep technical breakdown of a successful exploitation attempt" against the same Apache mod_php and PHP version. Multiple cybersecurity firms — Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack — had detected PHP2Shell exploitation attempts prior to public disclosure but had labeled those earlier attempts unsuccessful. Researchers at Amazon Threat Intelligence also saw targeting activity four days before the PHP patches were released. Dataminr's Threat Research and Cyber Engineering (TRACE) team characterized the pre-patch activity as limited to scanning, fingerprinting, and non-working exploits, with no known compromises until the Perplexity capture documented live RCE.

PHP security team timeline: patching PHP2Shell and a separate unpatched flaw

The PHP security team issued patches for the two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on Wednesday, October 21. That followed a request from the PHP developers the previous day asking administrators to prepare to install updates as soon as they became available. Prior to the patch release, details including the CVE identifiers, mitigation advice given to some critical infrastructure providers, and some proof-of-concept code had leaked online; the PHP security team maintained that published PoCs were not functional until the confirmed exploitation captured by Perplexity.

CVE-2026-115560: an unpatched RCE and the recommended interim mitigation

Separately, the PHP security team on Friday published mitigation guidance for a new RCE tracked as CVE-2026-115560. That vulnerability, the team said, has no patch and is exploitable only when an "unusual combination of configuration and application code" is present. Until a patch is available, the PHP developers advised administrators to set session.upload_progress.enabled=0 to block potential attacks — the same configuration change they had recommended before the PHP2Shell patches became available.

What this means for technologists, enterprises, and security teams

• Technologists and security teams: the Perplexity capture changes the operational calculus from "attempted, unsuccessful exploitation" to confirmed RCE against at least one common stack (Apache mod_php with PHP 8.4.26). The PHP security team released patches for the two tracked CVEs on October 21 and has published a configuration mitigation for an additional unpatched RCE. Administrators were previously asked to prepare to install updates as soon as they were released.
• Enterprises and procurement leaders: the incident underscores that proof-of-concept code and leaked exploit details do not always equate to immediate, successful exploitation — but Perplexity's recording shows that working exploit chains can appear quickly after disclosure events. The PHP devs' guidance to set session.upload_progress.enabled=0 provides a temporary control for environments vulnerable to CVE-2026-115560 until a patch is available.
• Security operations and incident responders: prior vendor detections that flagged attempts as unsuccessful did not preclude a later successful exploitation, according to the combined reporting from Perplexity and independent confirmation. Dataminr TRACE had reported only scanning and non-working exploits before the Perplexity evidence of compromise.

The record supplied by Perplexity and endorsed by a separate researcher makes plain that the PHP2Shell flaws moved from theoretical to practical attack surface in real deployments. The PHP security team has distributed fixes for CVE-2026-109618 and CVE-2026-109619 and has advised a configuration change to mitigate CVE-2026-115560 until a patch arrives. Given the publicly stated scale of PHP exposure — VirusTotal estimates roughly 5.1 million PHP hosts exposed online and about 3.8 million with at least one port open, with PHP used on roughly 70% of websites — the confirmed RCE capture is a concrete data point that administrators and response teams can and should treat as urgent.

Read the original report: https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/