Critical PHP2Shell RCE Vulnerabilities (CVE‑2026‑109618/109619) Exploited in the Wild
What It Is — Two critical remote‑code‑execution flaws in PHP 8.4.26, tracked as CVE‑2026‑109618 and CVE‑2026‑109619 and collectively dubbed “PHP2Shell,” have been confirmed in‑the‑wild. Researchers from Perplexity captured live exploitation against an Apache mod_php deployment, observing a decoded 800 KiB cookie dump and a function‑address leak that fed a subsequent payload. The same activity was corroborated by Expel’s Marcus Hutchins and Amazon Threat Intelligence, confirming that attackers moved beyond scanning to actual code execution on a vulnerable worker process. The PHP security team issued patches on Oct 21 2026, after warning administrators to apply updates immediately. While earlier PoCs and exploit‑related chatter existed, this is the first public evidence of successful exploitation.
Affected Products — PHP 8.4.26 running under Apache mod_php (single‑worker configuration).
Why It Matters for Trust & Control Assurance — Demonstrates the need for continuous vulnerability‑management controls and auditable patch‑status evidence. Capability: CONTROL_MAPPING.
Recommended Actions —
- Inventory all servers running PHP 8.4.x and verify they are on 8.4.27 or later.
- Deploy the official PHP2Shell patches immediately.
- Enable continuous monitoring for the CVE identifiers using IDS/EDR signatures (e.g., CISA SIGMA rule).
- Capture and retain patch‑status logs as evidence for audit readiness.
Source: https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/