CISA added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, after researchers recorded the first working remote code execution shells against the bugs in the wild. Federal civilian agencies have until October 29 to patch.
PHP patched the two flaws, each rated CVSS 9.2, on October 21 after details leaked. Until now, observed activity had consisted mostly of scanning, fingerprinting and exploit attempts that did not work, according to Dataminr TRACE.
Perplexity Honeypots Record 35 Working PHP2Shell Shells
The change came from a honeypot report by Adel Karimi, detection and response lead at Perplexity. His honeypots, which ran PHP 8.4.26 under Apache mod_php with a single worker, logged 35 shells launched on October 24 across three machines. One IP address produced three shells on a single honeypot, while another spawned 32 across all three.
Marcus Hutchins of Expel described the data as “by far the highest quality confirmation of in-the-wild php2shell exploitation.” The flaws affect PHP web-handling versions going back to 5.4, and VirusTotal has estimated that more than 5.1 million PHP hosts are exposed.
How the Four-Stage HTTP Request Chain Executed Commands
The attackers used a chain of four HTTP request stages. Some requests exhausted PHP memory, others leaked memory contents, and the final stage executed a shell command. The traffic closely matched a public proof of concept. In one case a response delivered an 800 KiB decoded cookie dump. Karimi did not observe any second-stage payload download.
Why Karimi Limits the Findings to One Server Profile
Karimi cautioned that the result applies to an intentionally favorable profile, a single-worker mod_php setup, and should not be read as a measure of how reliably the exploit works elsewhere. The honeypot data therefore confirms that code execution is achievable in the wild but does not establish how widely it will succeed against production configurations.
CYFIRMA Ties Suspected North Korea Campaign to 216 PHP Hosts
Separately, security firm CYFIRMA reported a suspected North Korea-linked campaign, assessed with moderate confidence as part of the Lazarus family, that probes PHP infrastructure from 21 compromised nodes. CYFIRMA has monitored a private I2P channel used by the operators since October 22.
On October 24, the operators listed 216 unpatched or partly mitigated hosts in that channel. The list covers government bodies, banks, airports and payment platforms in the United States, Japan, South Korea, Australia and the European Union. CYFIRMA said the scanning is deliberately slow and the nodes are rotated, which means alerts based on request rates may miss it.
Unit 42 Retracts Its PHP2Shell Link to a European Government Breach
Palo Alto Networks Unit 42 withdrew an earlier claim that an attack on a European government agency was PHP2Shell activity. That attack involved agentic-AI post-exploitation and yielded password hashes and MFA secrets within two hours. Unit 42 said it cannot confirm that initial access came from these CVEs.
CVE-2026-115560 Adds a Separate PHP Advisory Without a Patch
PHP also published a separate advisory on October 23 for CVE-2026-115560, a remote code execution flaw. Exploitation requires an unusual change to session.serialize_handler at runtime together with upload progress enabled. The project will not ship a fix until its next release. The mitigation it lists is setting session.upload_progress.enabled to 0.
CISA SIGMA Rule and Industrial Vendor Product Checks
CISA issued a SIGMA detection rule alongside the KEV addition, and industrial vendors are checking whether their products are affected, according to published reports. The sequence of events on October 26 also produced a discrepancy in coverage: one outlet reported that morning that CISA had not yet flagged exploitation, and the KEV addition followed later the same day.
The KEV listing gives federal civilian agencies three days, until October 29, to patch.
