Hackers have begun exploiting critical PHP flaws that let them run malicious commands on vulnerable web servers without a password. The weaknesses, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, received emergency patches, but researchers say successful attacks followed within days of those updates.
PHP is a programming language that powers millions of websites worldwide. If abused, the flaws could let attackers read sensitive data, alter website files or install harmful software, depending on what permissions the server already grants.
How researchers spotted the attacks
Security researcher Adel Karimi, who works at Perplexity, caught the activity on honeypots—special test servers built to watch how attackers try to break in. The attempts succeeded against systems running PHP 8.4.26 with Apache, a common web-server software.
The attackers also pulled information from server memory and used it to push further commands. Karimi’s investigation recorded about 800KB of memory data accessed this way, and logged 35 successful command executions across three test servers on 24 October. Traffic came from two internet addresses; it is not clear whether the same people were behind both.
What the evidence does and does not prove
Karimi said the campaigns went beyond simply crashing weak servers: operators gained remote control paths after reading memory. Cybersecurity researcher Marcus Hutchins of Expel reviewed the material and said it offered strong evidence of real exploitation.
The confirmed method is tied to CVE-2026-109618. Researchers have not separately shown successful use of CVE-2026-109619. The hits were also on a particular setup, and it is not yet confirmed that the same approach would work as cleanly on every other PHP version or server layout.
Patches website owners should install
PHP maintainers have already shipped emergency updates in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators still on older builds are being told to move to these releases to reduce the risk of attack.
The documented successes were against honeypots, not named public sites. Even so, researchers say the results show PHP2Shell is an active threat, not only a theoretical bug—another reason to apply the latest security patches without delay.
Aasan alfaaz mein
Hackers PHP ki serious security problems ko use kar ke websites ke servers par commands chala rahe hain, bina password ke. Researchers ne test servers par 24 October ko 35 successful attacks dekhe. PHP update kar lena chahiye—naye versions mein yeh khamiyan fix ho chuki hain. Agar aapki site purane PHP par hai to jald update karein taake data aur files safe rahen.
