Hackers have started exploiting serious security flaws in PHP, a programming language used by millions of websites worldwide.
The vulnerabilities, known as PHP2Shell, allow attackers to run malicious commands on vulnerable web servers without needing a password.
The two security flaws, identified as CVE-2026-109618 and CVE-2026-109619, recently received emergency patches. However, researchers have now confirmed successful attacks just days after the updates were released.
Hackers Successfully Exploit PHP Flaws
Security researcher Adel Karimi, who works at Perplexity, discovered the attacks using special test servers designed to detect hacking attempts.
These systems, known as honeypots, allow researchers to monitor how hackers try to break into websites.
Karimi found that attackers successfully ran commands on test servers using PHP 8.4.26 with Apache.
The attacks also exposed information stored in the servers’ memory, which helped the hackers carry out further commands.
According to the investigation, researchers recorded 35 successful command executions across three test servers on October 24.
The activity came from two IP addresses, although it remains unclear whether the same attackers were responsible.
Researchers Confirm the Security Threat
Karimi explained that the attacks went beyond simply crashing vulnerable servers.
The hackers were able to access approximately 800KB of memory data and use that information to execute commands remotely.
Cybersecurity researcher Marcus Hutchins from Expel also reviewed the findings and confirmed that they provided strong evidence of successful exploitation.
However, the attacks were recorded on servers with a particular configuration.
Researchers have not confirmed whether the same method would work equally well against other PHP versions or server setups.
The available evidence directly confirms an attack method linked to CVE-2026-109618, but does not separately establish successful exploitation of CVE-2026-109619.
Security Updates Available
PHP developers have already released emergency updates to address the vulnerabilities.
The security fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Website owners using affected older versions should update their servers to protect against possible attacks.
If successfully exploited, the flaws could allow hackers to access sensitive information, change website files, or run harmful software, depending on the permissions available on the server.
The confirmed attacks show that PHP2Shell is now a real security threat rather than just a potential weakness.
Although the documented successful attacks targeted test servers, they demonstrate why website administrators need to install the latest PHP security patches.
The post Hackers Are Now Exploiting Critical PHP Flaws to Attack Websites appeared first on ProPakistani.