Circuit Wire — a daily news update from the Circuit.
Security researchers have reported confirmed exploitation of PHP2Shell, a pair of critical remote code execution flaws in the PHP scripting language, BleepingComputer reported on October 26.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP released patches on Wednesday, October 21, one day after warning administrators to prepare. Adel Karimi, who leads detection and response at Perplexity, reported honeypot evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26. Marcus Hutchins, a threat researcher at Expel, reviewed the findings and called them "by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far."
Karimi noted that the test used a favorable single-worker setup and does not show how reliably the exploit works on other configurations. Earlier reports in the week were mixed. The Record reported on October 23 that Sophos had retracted an early claim of successful exploitation and said it had seen only a small number of failed attempts. John Hultquist of Google said his team had not validated exploitation in the wild. Amazon reported attempts dating back to October 17, before the CVEs became public.
Researchers have linked some of the activity to botnets. Arctic Wolf tied attempts it observed to the Potassium botnet, and Cobalt connected its observations to a Mirai botnet. Other experts reported attempts to enlist devices in DDoS botnets. Spencer McIntyre of VulnCheck said many public proof-of-concept exploits do not work outside researcher environments. Hutchins said the memory protection known as ASLR hinders mass exploitation but is not a significant barrier to successful exploitation.
The exposure is large. PHP runs on about 70 percent of websites, and VirusTotal estimates that more than 5.1 million PHP hosts are exposed online, about 3.8 million of them with at least one port open to attack. Censys counted more than 41 million internet-facing PHP services on affected versions as of October 22, with about 1 million on a fixed release.
A third flaw, CVE-2026-115560, has no patch. It can be exploited only with an unusual mix of configuration and application code. PHP has advised setting session.upload_progress.enabled to 0 until a fix is released. CISA shared a SIGMA detection rule on Friday but had not yet listed the flaws as exploited.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.