Critical PHP Vulnerability: Hackers Actively Exploiting Systems

The PHP2Shell Threat: What You Need to Know

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially designated two critical PHP vulnerabilities, collectively known as PHP2Shell, as "actively exploited." These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to perform Remote Code Execution (RCE) on vulnerable systems. Notably, these attacks can be executed without requiring any user privileges.

While the PHP security team released patches on October 21, Amazon security researchers noted that hackers began exploiting these flaws four days before the official updates were available. Although initial reports and proof-of-concept exploits were incomplete, recent data has confirmed that successful attacks are now occurring in real-world environments.

Why This Threat Is Widespread

PHP is one of the most widely used technologies on the internet, powering approximately 70% of all websites. According to data from VirusTotal, there are over 5.1 million PHP hosts accessible online. Of these, roughly 3.8 million instances are potentially vulnerable due to open ports, which facilitates easier access for attackers.

Cybersecurity experts, including representatives from Perplexity, have detected attacks targeting Apache mod_php configurations running PHP version 8.4.26. Furthermore, the PHP team has warned users of another new RCE vulnerability (CVE-2026-115560). As of now, no patch exists for this flaw, which manifests through specific combinations of system configurations and application code.

Steps for Administrators

CISA has issued a directive for U.S. federal agencies, mandating that systems be secured and patched as quickly as possible. While this requirement officially applies only to government structures, the agency urges all private organizations to prioritize the remediation of these vulnerabilities.

Web developers and system administrators are advised to immediately verify the PHP versions running on their servers and update them to the latest secure releases. Given the high prevalence of PHP-based websites globally, such server-side flaws can lead to data breaches, site outages, or full unauthorized control by hackers. Continuous system monitoring and the tightening of security policies are essential to prevent potential incidents.