Critical PHP2Shell Vulnerabilities Allow Remote Code Execution, Attackers Already Exploiting Them

Researchers in security have verified that a pair of freshly disclosed remote code execution (RCE) defects—CVE-2026-109618 and CVE-2026-109619—are currently being leveraged by attackers in real‑world scenarios. Dubbed PHP2Shell, these flaws target a widely used PHP extension that permits command‑line access from web‑based scripts.

The vulnerabilities first came to light via the cybersecurity outlet BleepingComputer, which noted that threat actors have already used the bugs to execute arbitrary commands on susceptible servers. Each CVE carries a critical severity rating, indicating that a successful attack can grant an adversary complete control of the targeted machine without any legitimate credentials.

PHP continues to be a foundational technology for web development, driving a large portion of the dynamic content across the web. It is common for custom applications to employ extensions that connect PHP to the underlying operating system, and any flaw in that bridge can expose a direct route to the server itself. With PHP2Shell, the problem originates from inadequate input validation, permitting specially crafted data to slip past safeguards and trigger system commands.

Analysts in the industry point out that proof of active exploitation heightens the need for swift administrator response. Although the total breadth of the incidents remains unclear, initial signs indicate the exploits are being employed to install web shells, siphon data, and create footholds for additional lateral movement across networks.

In reaction, vendors have released patches that rectify the underlying input‑validation defects. These updates can be obtained via the usual distribution mechanisms for leading operating systems and web‑hosting services. Security personnel should deploy the patches without delay, scrutinize logs for any anomalous command‑execution events, and contemplate interim mitigations like turning off the vulnerable extension until the correction is applied.

The appearance of PHP2Shell highlights the persistent difficulty of safeguarding broadly used open‑source components. As adversaries persist in seeking high‑impact flaws, experts emphasize the need for continual software inventory, prompt patch cycles, and multi‑layered defenses to curtail the impact of any successful intrusion.