Hackers target servers using public PHP2Shell exploit code

Hackers are actively using publicly available exploit code to attack university and business websites running unpatched versions of PHP, CyberSecurityNews reported. GBHackers News separately reported that hackers have launched mass scanning campaigns using the public PHP2Shell exploit scripts. [1][2][3]

The attacks target two critical vulnerabilities in the PHP engine, identified as CVE-2026-109618 and CVE-2026-109619, which are collectively known as PHP2Shell. Both flaws carry a CVSS v4.0 severity score of 9.2. According to CyberSecurityNews, the security issues allow remote users to execute arbitrary commands on vulnerable servers without authentication. [1]

The PHP maintainers released patched versions to resolve the vulnerabilities on October 21, 2026. CyberSecurityNews reported that working exploit scripts published online shortly after the release led to immediate exploitation, as the underlying bugs exist within the core PHP engine itself rather than in individual application code. [1]