Critical PHP2Shell Flaws Enable Remote Code Execution, Attackers Confirmed Using Them

Security researchers have confirmed that two newly disclosed remote code execution (RCE) flaws, cataloged as CVE-2026-109618 and CVE-2026-109619, are being actively exploited in the wild. The vulnerabilities, collectively dubbed PHP2Shell, affect a popular PHP extension that enables command‑line interaction from web scripts.

The flaws were first highlighted by the cybersecurity news site BleepingComputer, which reported that malicious actors have already leveraged the bugs to run arbitrary commands on vulnerable servers. Both CVEs are rated as critical, meaning successful exploitation can give an attacker full control over the compromised host without needing valid credentials.

PHP remains a cornerstone of web development, powering a substantial share of the internet’s dynamic sites. Extensions that bridge PHP to the operating system are common in custom applications, and a weakness in such a bridge can open a direct path to the underlying server. In the case of PHP2Shell, the vulnerabilities stem from insufficient input validation, allowing crafted data to bypass security checks and invoke system commands.

Industry analysts note that the confirmation of real‑world exploitation raises the urgency for administrators to act. While the exact scale of the attacks is not yet known, early indicators suggest that the exploits are being used to deploy web shells, exfiltrate data, and establish footholds for further lateral movement within networks.

Vendors have responded by issuing patches that address the input‑validation errors at the core of the issue. The updates are available through standard distribution channels for major operating systems and web‑hosting platforms. Security teams are advised to apply the patches immediately, review logs for suspicious command‑execution activity, and consider temporary mitigation steps such as disabling the affected extension until the fix can be deployed.

The emergence of PHP2Shell underscores the ongoing challenge of maintaining the security of widely deployed open‑source components. As threat actors continue to hunt for high‑impact vulnerabilities, experts stress the importance of regular software inventory, timely patch management, and layered defenses to limit the damage of any successful breach.