PHP2Shell attacks confirmed on PHP 8.4.26 test servers

Honeypot tests logged remote command runs tied to a newly patched PHP bug, and site operators are being urged to install the latest security releases.

Attackers are actively abusing PHP2Shell flaws that let them run commands on vulnerable web servers without a password.

On 24 October, researchers recorded 35 successful command executions on three honeypot servers running PHP 8.4.26 with Apache.

Evidence strongly links the activity to CVE-2026-109618; successful abuse of CVE-2026-109619 has not been separately confirmed.

Emergency fixes are out in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; older installs should be updated.

Read the full story