Summary
- Two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively dubbed PHP2Shell and are confirmed exploited in the wild.
- The vulnerabilities affect PHP and allow attackers to execute arbitrary code remotely.
- PHP’s maintainers have published mitigation advice in response to active exploitation.
- Organisations running PHP-based web applications should treat this as a priority patching event.
- No further technical details on exploitation methods are confirmed in available source material.
What Has Happened
Two critical remote code execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619 and tracked collectively under the label PHP2Shell, have moved beyond proof-of-concept into confirmed active exploitation. The vulnerabilities were reported by BleepingComputer, with Infosecurity Magazine separately noting that PHP’s maintainers have published mitigation advice in response to the exploitation activity.
Scope of the Problem
PHP remains one of the most widely deployed server-side scripting languages on the internet, underpinning a significant share of web applications across industries. RCE vulnerabilities in core PHP infrastructure therefore carry a broad potential impact, affecting not just bespoke applications but also widely used content management systems, e-commerce platforms, and enterprise portals built on or integrated with PHP. The fact that exploitation is already occurring narrows the window available to security teams for a measured response.
What the Sources Confirm — and What They Do Not
The source material confirms that exploitation is active and that PHP’s maintainers have issued mitigation guidance. However, the available sources do not detail the specific attack vectors being used, the identity or motivation of the threat actors involved, the volume or geographic spread of exploitation attempts, or the precise versions of PHP affected beyond what is referenced in the CVE identifiers. Security teams should consult PHP’s official mitigation advisory directly for version-specific guidance.
Why Active Exploitation Changes the Calculus
The transition from a published vulnerability to confirmed in-the-wild exploitation is the inflection point that should shift this issue from a scheduled patching queue to an active incident management posture. Organisations that have not yet applied available mitigations are currently exposed, and the existence of active exploitation means threat actors have already demonstrated the capability and willingness to weaponise these flaws. Waiting for a convenient maintenance window is a risk decision that should be made consciously and with appropriate sign-off.
Why it matters
For CISOs, PHP2Shell represents the kind of foundational infrastructure risk that can affect a large number of assets simultaneously. PHP sits beneath many web-facing systems that organisations may not actively monitor at the runtime level. Active exploitation means the risk is no longer theoretical — attackers with RCE capability on a web server can pivot, exfiltrate data, deploy ransomware, or establish persistent access. The breadth of PHP’s deployment means the blast radius of unpatched systems could be substantial. CISOs should verify their asset inventory for PHP-dependent systems, confirm patch or mitigation status, and ensure web application firewall rules and runtime monitoring are active while patching is completed.
What to do now
- Review PHP’s official mitigation advisory, published in response to active exploitation, and apply recommended mitigations or patches without delay.
- Audit your asset inventory to identify all systems running PHP, including third-party applications and platforms that may not be immediately obvious.
- Escalate patching of PHP-based systems from routine scheduling to priority treatment given confirmed in-the-wild exploitation.
- Engage your web application firewall and runtime security controls to provide a compensating layer of defence while patching is in progress.
- Monitor for indicators of compromise on PHP-based web servers and review recent logs for anomalous activity that may indicate prior exploitation.
