PHP2Shell RCE flaws successfully exploited in the wild

Researcher Adel Karimi of Perplexity recorded confirmed remote code execution against an Apache mod_php install running PHP 8.4.26, exploiting the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. Patches shipped on October 21; earlier attempts were deemed unsuccessful. PHP also issued mitigation for a new unpatched RCE, CVE-2026-115560.

• Confirmed RCE via PHP2Shell against Apache mod_php on PHP 8.4.26
• Exploitation caught by Adel Karimi of Perplexity, confirmed by Marcus Hutchins
• Patches for CVE-2026-109618 and CVE-2026-109619 released October 21
• For unpatched CVE-2026-115560, admins advised to set session.upload_progress.enabled=0