PHP2Shell vulnerability patches released, first exploitation attempts in the wild monitored
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP released patches fixing two critical vulnerabilities named PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2); both vulnerabilities have been confirmed to enable unauthenticated remote code execution on Apache mod_php, affect almost all versions dating back to PHP 5.4, and the patches are included in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. WatchTowr said it monitored the first exploitation attempts in the wild around the patch release but did not observe successful cases, and Hadrian said exploitation in the wild has reached scale and most attacks abuse PHP's session upload-progress path. The vulnerabilities were discovered in August by Wiz, OpenAI and Calif using frontier AI models and responsibly disclosed; the PHP Foundation said AI helped find more PHP vulnerabilities than before, and 15 new CVEs have been released since July 1.