PHP2Shell security flaws now sucessfully exploited in the wild

Live updates

1. 1h ago

   PHP2Shell Security Flaws Actively Exploited in the Wild

   Critical remote code execution vulnerabilities known as PHP2Shell are actively exploited in the wild, prompting government warnings and emergency security responses across global networks. Two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to progress from initial probes to working shells and command execution on vulnerable Apache mod_php installations. CISA confirmed active exploitation of the bugs, while security vendors and network product providers like Palo Alto Networks rushed to deploy protections and assess widespread risk.

   Why it matters

   The vulnerabilities affect PHP installations and have triggered a scramble for patches and stopgap controls across the web. Amazon Threat Intelligence previously identified exploitation prior to public disclosure within monitoring systems, while honeypots captured rapid shell command executions. Security researchers and automated AI platforms are heavily involved in both tracking the global fallout and analyzing post-compromise behaviors.

   What is confirmed

   • Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively tracked as PHP2Shell.
   • CISA confirmed active exploitation of the two PHP2Shell flaws enabling remote code execution.
   • Palo Alto Networks confirmed that PAN-OS and other network products are affected by the PHP2Shell flaws.

   Still unconfirmed

   • Palo Alto Networks Unit 42 retracted an earlier assessment stating that post-compromise activity targeting a European government agency was driven directly by the PHP2Shell CVEs.

   What to watch next

   • Deployment of official patches from software vendors
   • Confirmation of additional vendor products impacted by the remote code execution flaws
   • Further tracking of agentic AI use in post-exploitation activity
   Sources used for this update (23)

   1. thehackernews.com — Vulnerability | Breaking Cybersecurity News | The Hacker News
   2. www.bleepingcomputer.com — Retail giant Ahold Delhaize takes systems offline after cyberattack - BleepingComputer
   3. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   4. Cloudflare Blog — Cloudflare deploys protections against php2shell vulnerability
   5. OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities
   6. Amazon Web Services — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
   7. The Atlantic — The Safe Internet Is Shrinking
   8. Reuters — PHP Foundation 'under-funded' with one full-time staff member, director says
   9. The New York Times — The 5 Things You Need to Know About the PHP Security Flaw Breaking the Internet
   10. BBC — The PHP developer who became the unsung hero of the internet
   11. CNN — AI is exposing how fragile the web really is. What you can do to stay safe
   12. BleepingComputer — PHP2Shell security flaws now sucessfully exploited in the wild
   confidence 90%