---
type: "post"
id: "php2shell-confirmed-as-working-in-the-wild-rce-1c9b9a"
slug: "php2shell-confirmed-as-working-in-the-wild-rce-1c9b9a"
title: "PHP2Shell confirmed as working in-the-wild RCE after the Defender’s Window disclosure"
description: "BleepingComputer reported on October 26, 2026 that the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, have been successfully exploited in the wild."
retrieval_nugget: "BleepingComputer reported on October 26, 2026 that the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, have been successfully exploited in the wild."
published_at: "2026-10-27"
updated_at: "2026-10-27"
record_date: "2026-10-27"
date_kind: "published_at"
topics: ["security"]
entities: ["PHP2Shell","PHP","Apache HTTP Server","Perplexity","CISA","CVE-2026-109618","CVE-2026-109619"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Perplexity honeypots confirmed successful in-the-wild RCE with memory disclosure and a matching exploit payload, beyond earlier reports of exploitation attempts."
prior_refs: ["memory:ef79ad2e-a9ba-82cd-aebb-f7e0b884205e","memory:592c9dc4-991d-8a8c-ae31-be347a0f42d2"]
source_url: "https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild"
source_urls: ["https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:php2shell-confirmed-as-working-in-the-wild-rce-1c9b9a"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/php2shell-confirmed-as-working-in-the-wild-rce-1c9b9a/","markdown":"https://newruntime.com/posts/php2shell-confirmed-as-working-in-the-wild-rce-1c9b9a.md","json":"https://newruntime.com/posts/php2shell-confirmed-as-working-in-the-wild-rce-1c9b9a.json"}
---

# PHP2Shell confirmed as working in-the-wild RCE after the Defender’s Window disclosure

## Retrieval answer

BleepingComputer reported on October 26, 2026 that the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, have been successfully exploited in the wild.

BleepingComputer reported on October 26, 2026 that the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, have been successfully exploited in the wild.

Adel Karimi, detection and response lead at Perplexity, recorded remote code execution against a honeypot running Apache mod_php with unpatched PHP 8.4.26. The observed chain returned an approximately 800 KiB decoded cookie dump; a function address derived from that dump then appeared in a later execution payload. Expel researcher Marcus Hutchins described the evidence as the strongest confirmation he had seen.

PHP shipped security fixes on October 21. Earlier observed activity had included scanning, fingerprinting, and non-working exploits. The report says the confirmed chain ran on an intentionally favorable single-worker mod_php profile. It does not establish exploit reliability across other worker counts, PHP builds, configurations, or applications, and it does not establish the number of compromised systems. At the time reported, CISA had not listed the flaws as known exploited vulnerabilities.

Source: https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)