Cybercriminals are actively targeting severe security flaws in PHP, a programming language powering millions of sites globally. Named PHP2Shell, these vulnerabilities permit malicious actors to execute harmful commands on targeted web servers completely without passwords. Emergency patches recently arrived for these two security weaknesses, tracked as CVE-2026-109618 and CVE-2026-109619, but investigators documented active attacks just days following the update releases.
Hackers Successfully Exploit PHP Flaws
Perplexity security researcher Adel Karimi spotted the malicious activity using specialized test servers created to spot hacking attempts. Such systems, called honeypots, enable experts to track how intruders attempt to compromise websites. Karimi discovered that intruders successfully ran commands on test servers running PHP 8.4.26 alongside Apache.
The assaults additionally leaked data contained within server memories, assisting the perpetrators in launching subsequent commands. Based on the inquiry, specialists documented 35 successful command executions distributed across three test servers on October 24. This activity originated from two IP addresses, though experts cannot yet determine if identical actors carried out both operations.
Researchers Confirm the Security Threat
Karimi stated that the attacks extended past merely crashing susceptible servers. The malicious actors managed to access roughly 800KB of memory data and used that material to run remote commands. Marcus Hutchins, a cybersecurity researcher at Expel, also analyzed the discoveries and verified that they offered solid proof of successful exploitation. Even so, the attacks were tracked on servers featuring a specific configuration.
Investigators have not verified if this exact technique functions successfully against alternative PHP versions or server arrangements. Available evidence explicitly confirms an attack vector tied to CVE-2026-109618, while failing to independently prove successful exploitation of CVE-2026-109619.
Security Updates Available
PHP maintainers already rolled out emergency patches to resolve the vulnerabilities. These security fixes are provided within PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Website operators running vulnerable legacy versions must upgrade their servers to safeguard against potential breaches. Successful exploitation of these defects might grant intruders entry to confidential data, alter site files, or deploy malicious applications, depending upon server permissions.
The verified attacks indicate that PHP2Shell represents an actual security danger rather than a theoretical weakness alone. Even though the documented successful assaults focused on test servers, they highlight the necessity for website administrators to deploy the newest PHP security patches.
