Security2 sources
PHP2Shell RCE flaws exploited in the wild, 35 shells launched on Oct 24
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have been successfully exploited in the wild. Attackers used the flaws to launch 35 shells from two IP addresses against honeypots on October 24.
Why it matters: Unpatched PHP installations are now actively being compromised, requiring immediate remediation.
Read the coverage
This story so far
How it developed, day by day.
Tuesday 27 October
PHP2Shell RCE flaws exploited in the wild, 35 shells launched on Oct 24 (this page)
Sunday 25 October
Critical PHP bugs threaten widespread web servicesSaturday 24 October
PHP team releases mitigation steps for new remote code execution flawFriday 23 October
Hackers exploited PHP2Shell bugs four days before patches releasedThursday 22 October
PHP releases emergency patches for two critical PHP2Shell RCE flaws (CVE‑2026‑109618, CVE‑2026‑109619)Wednesday 21 October
PHP warns of two critical flaws, emergency patches due tomorrow
More in Security
Security11h ago2 sources
Security13h ago2 sources
Security11h ago2 sources