PHP2Shell Security Flaws Now Successfully Exploited
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Researchers report that the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) have been exploited successfully in the wild, days after patches shipped and after earlier attempts failed. Adel Karimi's honeypot logged remote code execution with memory disclosure against Apache mod_php on PHP 8.4.26, and Marcus Hutchins backed the analysis. Most of these details were not independently verified. Karimi notes the evidence covers a deliberately favorable single-worker setup, not general reliability. Teams running mod_php should confirm the patches are applied.