PHP2Shell Security Flaws Now Successfully Exploited
The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution…
The PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been successfully exploited in the wild, as reported by Adel Karimi, detection and response lead at Perplexity. The malicious activity was detected in honeypots recording evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.
The exploitation resulted in an 800 KiB decoded cookie dump and a function address derived from that dump, which appears in the subsequent execution payload. The successful exploitation demonstrates a chain of events on an intentionally favorable single-worker mod_php profile, signaling a significant security concern for affected systems.
Brief written by urgent.news from Slashdot's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
