Although Techzine reported earlier today that, according to the PHP Foundation, cybercriminals had not yet succeeded in exploiting PHP2Shell vulnerabilities, attackers have since managed to “exploit” the software flaws.
This was reported by BleepingComputer. The two security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were patched last week with emergency patches. Even before those patches were available, however, attackers were attempting to exploit the vulnerabilities. Until earlier today, however, there was no convincing evidence that they had succeeded.
Perplexity has now provided that evidence. Their analysis shows that attackers executed code on an Apache server running PHP 8.4.26. The attackers also extracted data from the server’s memory.
This included, among other things, a file containing approximately 800 kilobytes of cookie data. Using that information, they determined an address that they later used to execute a shell command.
Attacks began before patches were released
Security researchers have been investigating these vulnerabilities for over a week. Amazon Threat Intelligence discovered that attackers were already targeting PHP2Shell four days before the emergency patches were released. Cloudflare and several other security firms also detected suspicious activity.
Initially, the activity mainly involved searching for vulnerable servers and testing exploits that did not work. The first attempts took place before the technical details of the security vulnerabilities were officially disclosed.
The PHP security team carefully prepared the announcement but couldn’t prevent information from leaking early. This included, among other things, the CVE numbers and technical measures that certain critical infrastructure administrators had already received.
Another serious PHP vulnerability
Meanwhile, the PHP developers have warned about a third vulnerability. No patch is yet available for this security vulnerability, CVE-2026-115560.
According to the developers, the risk is more limited than with PHP2Shell. Exploitation is only possible on systems with a specific, unusual combination of configuration settings and application code.
For now, administrators can prevent attacks by setting `session.upload_progress.enabled=0`. This measure was previously recommended as a temporary safeguard against PHP2Shell.
Security issues in PHP can have significant impact. The programming language is used by approximately 70 percent of all websites. According to a recent VirusTotal analysis, more than 5.1 million PHP hosts are accessible via the internet worldwide. On about 3.8 million of these, at least one port is accessible and could potentially be exploited.