PHP2Shell exploit code weaponized by hackers to target universities, businesses

Key Takeaways

• Public exploit code for two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), collectively known as PHP2Shell, is actively being weaponized.
• The primary targets include web servers operated by universities and businesses.
• These vulnerabilities, rated 9.2 CVSS v4.0, allow unauthenticated remote code execution.
• Patches were released on October 21, 2026, but many systems remain vulnerable.
• The flaws reside within the PHP engine itself, making direct patching the only effective defense.

Hackers Exploit PHP2Shell Vulnerabilities to Target Educational and Business Infrastructure

Cybercriminals are actively leveraging readily available exploit code to compromise web servers running PHP, with a notable focus on academic institutions and corporate entities. This surge in attacks exploits two severe vulnerabilities, collectively dubbed PHP2Shell, which were recently disclosed in the PHP engine.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both carry a critical CVSS v4.0 score of 9.2. They enable an attacker to execute arbitrary commands on a vulnerable server without requiring any authentication, posing a significant risk to affected systems.

While the PHP development team released crucial security updates on October 21, 2026, many web servers had not yet applied these patches when functional exploit scripts rapidly surfaced online. This created a critical window of opportunity for attackers.

According to the PHP project, these flaws are deeply embedded within the PHP engine itself. This means that even meticulously coded websites do not inherently protect a server from exploitation. The risk is particularly elevated for Apache servers configured to run PHP as a module (mod_php), as the vulnerability can be triggered before any site-specific code has a chance to execute. Traditional security measures like firewalls and web application filters may also fail to detect the malicious requests, underscoring the necessity of timely patching.

Researchers from Akatsuki Legion, an independent adversary research group, identified this malicious activity and documented it comprehensively in a public report. Their analysis credits the exploit chain to a researcher known as 9bie, noting that AI-generated proof-of-concept scripts appeared on GitHub almost immediately after the October 21 patch release.

Akatsuki Legion further collected telemetry from its honeynet, publishing the tools observed in use. This information is available in the group’s research archive. For a deeper dive into the exploit chain and its mechanics, refer to the detailed report from Researchers from Akatsuki Legion, an independent adversary research group, identified.

Technical Details of the PHP2Shell Exploits

The public exploit code illustrates how these two vulnerabilities are chained together. CVE-2026-109618 manifests when PHP encounters an out-of-memory condition during an upload process. This leads to a cleanup routine operating on partially constructed data, creating an exploitable state.

The second vulnerability, CVE-2026-109619, involves the persistence of old request data within a shared worker process, allowing a subsequent request to reuse this stale information. Attackers leverage two memory leaks to ascertain memory addresses, then inject a fabricated structure into memory. This tricks PHP into invoking its system function, thereby executing a command chosen by the attacker. Further technical insights can be found in the comprehensive report detailing the weaponization of public PHP2Shell exploit code.

Intriguingly, exploit probing for these vulnerabilities began even before their public disclosure. Amazon Threat Intelligence observed initial exploit attempts as early as October 17, four days prior to the release of official fixes. This pre-disclosure activity indicates that some servers may have been targeted before administrators were even aware of the existence of these critical bugs. Telemetry from Hunt.io further corroborates this, recording three distinct exploit toolkits, including a mass-exploitation script, on October 21.

Botnet Link Emerges

Akatsuki Legion also documented an open directory hosting listener scripts that recorded exploit traffic on ports 80 and 8888. This collective evidence points to multiple threat actors simultaneously sharing and testing the PHP2Shell exploit code.

Further investigations by Sophos have established a clear link to botnet activity. Sophos analyzed a blocked payload sample from the Potassium botnet, which appeared to be a variant of Mirai. While their customer data showed scanning and several failed attempts, no successful compromises were confirmed. However, the sample’s check for a Linux program before execution strongly suggests an intent to convert compromised servers into Distributed Denial of Service (DDoS) bots.

What You Should Do

• Immediately Update PHP: Upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Linux distribution channels likely already carry these patches due to early release to vendors. Refer to the official security advisory for specific details on affected branches.
• Address End-of-Life PHP Versions: If your environment uses PHP 8.1 or older, which no longer receive official updates, prioritize migrating to a supported version or obtaining vendor-specific backports.
• Verify All PHP Runtimes are Patched: Ensure that PHP-FPM, Apache modules, containers, and bundled appliances are running the updated builds. Simply updating the command-line PHP package might leave live services exposed.
• Implement Temporary Mitigations (Not a Replacement for Patching): While not a complete fix, setting session.upload_progress.enabled to 0 and restarting workers can reduce risk.
• Inventory and Monitor: Conduct a thorough inventory of all PHP runtimes within your organization. After patching and restarting services, actively monitor logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS, which can indicate attempted exploitation.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.