Researchers Confirm In-the-Wild Exploitation of Critical PHP2Shell Flaws

The activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. Karimi said the response delivered an 800 KiB decoded cookie dump and that a function address derived from that dump, using the public exploit's offsets, appeared in the subsequent execution payload.

"This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said. He added that the evidence demonstrates the chain on an intentionally favorable single-worker mod_php profile and is not a measurement of exploit reliability on other worker counts, PHP builds, or applications.

Expel threat researcher Marcus Hutchins confirmed Karimi's findings. Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports, called it "by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far." He described it as a deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26.

The confirmed exploitation comes after patches were released for the vulnerabilities and after earlier exploitation attempts failed, according to the report. The evidence recorded by Karimi's honeypots shows remote code execution with usable memory disclosure, rather than only a crash and a suspicious process.

Karimi's account and Hutchins's confirmation focus on a specific Apache mod_php installation running PHP 8.4.26. Karimi said the single-worker mod_php profile was intentionally favorable for the demonstration and that the result should not be read as a measure of exploit reliability on other configurations.

The PHP2Shell vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.