PHP2Shell Vulnerabilities Exploited in Live Attacks

"Patching closes the door. It doesn’t tell you who is already inside."

Adel Karimi: PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploited in the wild

Adel Karimi, detection and response lead at Perplexity, has determined that the PHP2Shell vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 have been exploited in the wild. That determination moves the story from a patch advisory into an active incident posture: a confirmed exploitation means defenders must assume some vulnerable servers were accessed before patches were applied.

Exabeam's timeline: from scanning to remote code execution within days of October 21 patches

Steve Povolny, Vice President of AI Strategy & Security Research at Exabeam, describes a rapid progression. According to Povolny, the PHP2Shell flaws “went from scanning noise to confirmed remote code execution on a honeypot within days of the October 21 patches.” His account highlights a narrow window between public patch availability and live compromises — a period in which unpatched sites remain at acute risk.

How an attacker behaves after code execution, per Exabeam

Povolny lays out the behavior defenders should expect after an attacker gains code execution on a web server. He warns attackers typically pivot: they “look for stored credentials, try a few accounts, and move to something more valuable.” He stresses that each individual step can appear routine — for example, a server’s odd outbound connection or a service account logging in from an unusual location — but seen together they form a pattern of active compromise. His point: patching is necessary but not sufficient, because it prevents future exploitation without revealing past intrusions.

Reactions in the security community

The announcement of the PHP2Shell flaws and subsequent exploitation prompted urgent commentary. Ben Ronallo, Principal Cybersecurity Engineer at Black Duck, called the flaws’ announcement “a genuine drop-everything moment.” Povolny’s longer assessment frames a persistent gap in operational practice: measuring patch speed is straightforward, he says, but far less energy goes into asking whether organizations would notice a compromise that already occurred.

What this means for technologists, affected enterprises, and adversaries

• Technologists and security teams: Expect that patching alone will not prove a server is clean. Povolny’s guidance implies teams should look for the combination of anomalies — e.g., odd outbound connections together with unexpected service‑account logins — and judge servers and accounts “against what normal looks like for each of them.”
• Affected enterprises and procurement leaders: The October 21 patches closed an entry vector, but organizations that did not patch immediately remain at risk. As Povolny notes, installing the fix “now does nothing about an intruder who got in last week.” For those organizations, incident response and forensic review must accompany remediation.
• Adversaries and threat operators: The public timeline from scanning to remote code execution within days demonstrates that rapid weaponization follows disclosure and patching. Povolny’s description of attacker behavior — searching for stored credentials and escalating to more valuable targets — outlines the operational incentives an adversary follows after initial access.

The narrow factual record here is stark: two CVEs were published, patches appeared around October 21, researchers observed scanning and then confirmed remote code execution on a honeypot within days, and experts warn that patching does not reveal prior intrusion. The practical consequence, in the words of Povolny, is that defenders who treat the exploit as “the start of the story” — and who correlate modest anomalies to reveal a larger chain of activity — are the teams most likely to find and remove intruders who arrived before a patch closed the door.

Original reporting: https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild