PHP2Shell Vulnerabilities Now Successfully Exploited in Real-World Attacks

Two critical vulnerabilities in PHP, one of the most widely used programming languages for websites, have now been successfully exploited in real-world attacks. The development raises concerns for businesses operating PHP-based websites, including e-commerce platforms and online services.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, allow attackers to execute malicious code remotely on vulnerable servers.

Although security researchers had previously detected numerous attempts to exploit the flaws, the latest findings provide concrete evidence that attackers can successfully execute commands on affected systems.

The confirmation comes just days after the PHP security team released emergency patches on October 21, 2026.

Researchers Confirm Successful Exploitation

According to BleepingComputer, Adel Karimi, Perplexity’s detection and response lead, identified the successful exploitation.

Karimi’s security honeypots, systems designed to attract and monitor malicious activity, recorded evidence of remote code execution against an Apache server running PHP 8.4.26.

The findings showed that attackers could exploit the vulnerabilities to extract information from the server’s memory and then execute commands.

Security researcher Marcus Hutchins from Expel independently reviewed the evidence and confirmed the discovery’s significance.

However, the demonstrated attack involved a specific server configuration. The findings do not establish that the same exploit will work equally reliably across every vulnerable PHP installation.

Nevertheless, this confirmation marks an important development in the PHP2Shell incident, moving the threat from attempted exploitation to demonstrated remote code execution.

Attacks Began Before Security Patches Were Available

The PHP2Shell vulnerabilities had already attracted considerable attention before the official security updates were released.

Amazon Threat Intelligence reported detecting attempts to exploit the flaws on October 17, four days before the patches became available.

Other cybersecurity companies, including Cloudflare, Hadrian, watchTowr, and Patchstack, also observed suspicious activity before public disclosure.

At that stage, researchers had not confirmed successful exploitation. Many attempts involved scanning, identifying vulnerable systems, or using proof-of-concept exploits that didn’t work as intended.

The situation was further complicated when technical details about the vulnerabilities leaked before the coordinated disclosure.

After security patches were released on October 21, researchers continued monitoring exploitation attempts. Karimi’s findings now demonstrate that at least one attack technique can successfully achieve remote code execution under the tested conditions.

The vulnerabilities have also attracted attention from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which added both flaws to its Known Exploited Vulnerabilities Catalog.

Why PHP2Shell Matters for E-commerce

PHP remains a fundamental technology behind a significant portion of the internet.

According to estimates cited by BleepingComputer, approximately 70% of websites use PHP, including websites built with popular content management systems such as WordPress.

PHP also powers e-commerce environments, including platforms such as WooCommerce and Magento, as well as other applications that support online stores.

A vulnerability in PHP can therefore affect more than one website or application. If attackers exploit a vulnerable server, they may access sensitive information, disrupt website operations, or execute unauthorized commands.

For e-commerce businesses, such incidents can put customer information, transaction-related systems, and service availability at risk.

Companies that manage extensive product catalogs and integrate with external systems must also secure the infrastructure supporting those operations.

While structured product data providers such as Icecat help businesses distribute product information across e-commerce channels, the security of the underlying websites, APIs, and server environments remains a separate and essential responsibility.

Security Updates Remain the Primary Defense

The PHP security team released patched versions on October 21 to address the two critical vulnerabilities.

Update the affected software to a fixed release, including PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the version in use.

Organizations running unsupported PHP versions should also evaluate migration options or contact their software providers about available security fixes.

Temporary mitigation measures may reduce exposure to certain attack methods, but PHP developers have emphasized that applying the official security updates is the most reliable long-term protection.

A separate vulnerability, CVE-2026-115560, was also disclosed on October 23. Unlike the original PHP2Shell flaws, this issue remained unpatched at the time of reporting and requires an unusual combination of server configuration and application code to exploit.

Administrators were advised to disable the PHP session upload progress feature as a temporary mitigation for that additional vulnerability.

A Reminder of the Risks Facing Web Infrastructure

The confirmed exploitation of PHP2Shell demonstrates how quickly serious vulnerabilities can become active security threats.

Although patches are available for the original two flaws, businesses must still keep their servers updated and investigate suspicious activity.

The incident is particularly relevant for e-commerce companies, whose websites depend on interconnected technologies to manage products, payments, customer accounts, and other essential operations.

As cyberattacks continue to target widely deployed software, keeping infrastructure up to date and responding quickly to security advisories remain essential to protect online services and customer trust.