Hackers exploit PHP2Shell flaws days after emergency patches
Hackers have begun exploiting serious security flaws in PHP, the programming language behind millions of websites, just days after emergency fixes were released.
The flaws, known as PHP2Shell, let attackers run malicious commands on vulnerable web servers without a password. Security researchers have now confirmed successful attacks, turning what was a warned weakness into a live threat.
How the attacks were found
Security researcher Adel Karimi, who works at Perplexity, found the attacks using honeypots. These are test servers set up to attract hacking attempts so researchers can watch how attackers work.
Karimi found that attackers ran commands on test servers using PHP version 8.4.26 with Apache, a common web server setup. The attacks exposed information stored in the servers’ memory, which the attackers then used to run further commands.
Researchers recorded 35 successful command executions across three test servers on 24 October. The activity came from two IP addresses, though it is not yet clear whether the same attackers were behind both.
Cybersecurity researcher Marcus Hutchins, from Expel, reviewed the findings and confirmed they gave strong evidence of successful exploitation.
What is confirmed, and what is not
One limit matters. The evidence directly confirms an attack method linked to one flaw, CVE-2026-109618. It does not separately establish successful exploitation of the second flaw, CVE-2026-109619.
The attacks were also recorded on servers with one particular setup. Researchers have not confirmed whether the same method works as well against other PHP versions or server setups.
That caution does not weaken the warning. Attackers test a proven method against many servers, and servers that match the tested setup are at clear risk. Servers on other setups should still patch, because the flaws are real and the fixes are ready.
The patches to install
PHP developers have already released emergency updates. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Website owners on older versions should update at once. If exploited, the flaws could let hackers read sensitive information, change website files or run harmful software, depending on the permissions on the server.
For Pakistani website owners, the warning is direct. A large share of Pakistani business, news and government websites run on PHP-based systems such as WordPress. An unpatched server is not a theoretical risk. It is a server that automated attacks can find and test within days of a patch release, as this case shows.
The practical steps are short: check the PHP version on the server, update to the fixed version for that branch, and confirm the site still works after the update. Hosting providers can usually do this on request, and site owners who manage their own servers should treat it as urgent rather than routine maintenance.
The lesson of PHP2Shell is timing. Patches only protect servers that install them. Once researchers confirm live exploitation, the gap between patching and attack closes fast.
What are the PHP2Shell flaws?
They are two security flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that let attackers run commands on vulnerable web servers without a password.
Which PHP versions are fixed?
The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Owners on older versions should update to the fixed version for their branch.
Have the flaws been used in real attacks?
Yes, on test servers. Researchers recorded 35 successful command executions across three honeypot servers on 24 October, using PHP 8.4.26 with Apache.
—
Sources and prior coverage
- ProPakistani, “Hackers Are Now Exploiting Critical PHP Flaws to Attack Websites” (27 October 2026): https://propakistani.pk/2026/10/27/hackers-are-now-exploiting-critical-php-flaws-to-attack-websites/
