PHP2Shell Flaws Now Confirmed Under Active Attack as Researchers Capture Working Exploits

The US cyber agency CISA has confirmed that attackers are exploiting both critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. It added them to its Known Exploited Vulnerabilities catalog on Monday and set an October 29 deadline for US federal civilian agencies to fix them. Last week the agency had warned of the danger but said it had not seen successful exploitation. Both flaws are rated 9.2 on the CVSS scale and can be used without logging in to run code on vulnerable PHP servers.

Patches were released on October 21, but attackers moved first. AWS saw exploitation attempts as early as October 17, four days before public disclosure. On October 24, Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots (decoy servers) running PHP 8.4.26 under Apache mod_php. The activity was consistent with CVE-2026-109618, and he found no evidence the second flaw was involved. Attackers then tried to contact external servers, though no extra malware was downloaded. Karimi cautioned that the honeypots used a favourable setup, so results may not reflect how reliably the attack works on production servers.

The wider picture is concerning. Delft University's Threat Intelligence Lab has tracked more than 50,000 exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing and began sending exploit code or malware droppers.