Honeypot data confirms the first successful in-the-wild PHP2Shell code execution
A Perplexity detection lead recorded a full exploit chain against PHP 8.4.26, and Security Affairs reports that a suspected North Korean campaign is targeting 216 vulnerable hosts.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
The two critical PHP remote code execution flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, have now been exploited successfully in the wild, BleepingComputer reports. Adel Karimi, detection and response lead at Perplexity, says his honeypots recorded confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. According to Karimi, the attack first leaked memory as an 800 KiB decoded cookie dump. A function address derived from that dump, using the public exploit's offsets, then appeared in the execution payload, and the shell command ran about 1.6 ms after the request's final captured byte. Expel threat researcher Marcus Hutchins, who has been tracking claims of successful exploitation, called it the highest-quality confirmation he had seen so far. Separately, Security Affairs reports that a suspected North Korean campaign is targeting 216 vulnerable PHP hosts. PHP patched the flaws on October 21. Earlier reports had described millions of exploitation attempts and a working ASLR bypass, but no confirmed compromise. Confirmed code execution means unpatched servers face a real risk of takeover, so administrators who have not yet applied the PHP updates should treat patching as urgent.