Two critical PHP vulnerabilities, collectively called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been confirmed to be exploited in the wild, with evidence of successful remote code execution on Apache mod_php running PHP 8.4.26. Security researchers and threat analysts observed active exploitation attempts before and after emergency patches were released on October 21, 2026, prompting advisories for immediate patching and mitigation measures to protect millions of exposed PHP-based web servers.
PHP2Shell Security Flaws Now Sucessfully Exploited in the Wild
