PHP2Shell flaws confirmed exploited in the wild

Karimi said the evidence from Perplexity's honeypots showed remote code execution against an Apache mod_php system running PHP 8.4.26. He said the response included an 800 KiB decoded cookie dump, and that a later payload appeared to use an address derived from that dump.

Hutchins of Expel said he had been tracking reports of supposed PHP2Shell exploitation and regarded Karimi's material as the strongest confirmation so far. He described it as a detailed account of a successful attempt against the same kind of PHP setup.

CISA published a SIGMA rule for PHP2Shell exploitation attempts on Friday, although the agency has not said the flaws were exploited in the wild. The PHP security team patched the two CVEs on 21 October, one day after telling administrators to be ready for the updates.

The article said details on the flaws and some proof-of-concept exploits leaked before the patches were released, but the PHP team said those exploits did not work. It also said Cloudflare, Hadrian, watchTowr, Previdian and Patchstack saw attempts that failed, and that Amazon Threat Intelligence noticed attacker activity four days before the patches were issued.

Dataminr's TRACE team said the activity had been limited to scanning, fingerprinting and non-working exploits, with no known compromises. The PHP team also published mitigation advice for CVE-2026-115560, including setting session.upload_progress.enabled to 0 until a patch is available.