Tech · 7 d ago
Critical PHP flaws now exploited in real attacks, researchers confirm
Two critical remote-code-execution flaws, together called PHP2Shell, have been exploited in a real attack, researchers say. Adel Karimi of Perplexity caught it on honeypots running Apache mod_php with PHP 8.4.26, and Expel's Marcus Hutchins confirmed it.
What we know
- Code execution confirmed on Apache mod_php, PHP 8.4.26
- PHP patched the flaws on Oct 21
Not yet
- How reliable the exploit is on other setups
- Not yet listed as exploited by US agency CISA
Karimi said the result is not a measure of how reliable the exploit is on other setups.
Reach of PHP
70 % of websites run PHP
PHP runs roughly 70% of all websites, and VirusTotal counts more than 5.1 million PHP hosts exposed online.
What admins can do
Administrators should install the Oct 21 patches. A separate flaw with no patch yet (CVE-2026-115560) can be blocked for now by setting session.upload_progress.enabled=0.
