PHP2Shell: Critical PHP RCE Exploited in the Wild | Freewares

If your website runs on PHP, stop scrolling. Two critical vulnerabilities in the language are being exploited in the wild right now, and the gap between "theoretical risk" and "someone else's code running on your server" has officially closed.

Security researchers call the attack PHP2Shell. It chains two freshly disclosed flaws, CVE-2026-109618 and CVE-2026-109619, to execute arbitrary code on a vulnerable server with no login required. No credentials, no user interaction, just a crafted request hitting the wrong endpoint.

Confirmed in the wild, not just on paper

Plenty of vulnerabilities sound scary and never leave the lab. This one did. Honeypots operated by security researchers captured a successful exploitation against an Apache server running PHP 8.4.26, according to Integrity360's weekly roundup. The U.S. Cybersecurity and Infrastructure Security Agency had set October 29 as the patch deadline for federal agencies, a deadline that has now passed. India's CERT-In published its own advisory on October 22.

When CISA gives federal agencies a hard date, it is usually because exploitation is already happening, not because it might happen someday.

Why this one stings

PHP still powers a huge share of the web, from WordPress blogs to custom admin panels nobody has touched in years. An unauthenticated remote code execution flaw in that ecosystem is about as bad as web vulnerabilities get: the attacker does not need an account, a password, or a mistake from your users. They just need your server to be reachable and unpatched.

And because PHP often hides behind frameworks, CMSs, and shared hosting stacks, plenty of site owners have no idea which version they are actually running.

What to do today

If you manage your own server, check your version with php -v and update through your package manager. If you are on shared or managed hosting, look for a PHP version setting in your control panel or open a ticket with your provider. Then skim your access logs for anything that looks like probing.

It takes five minutes. Cleaning up after a compromise takes weeks.