Hackers Are Now Exploiting Critical PHP Flaws to Attack Websites

Hackers have began exploiting serious security flaws in PHP, a programming language employed by millions of websites worldwide.

Key points

• The available evidence directly confirms an attack method linked to CVE-2026-109618, but does not separately establish successful exploitation of CVE-2026-109619.
• The two security flaws, identified as CVE-2026-109618 and CVE-2026-109619, lately received emergency patches.
• The security fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Karimi discovered that attackers successfully ran commands on test servers using PHP 8.4.26 with Apache.
• According to the investigation, researchers recorded 35 successful command executions throughout three test servers on October 24.

Notably, the vulnerabilities, known as PHP2Shell, allow attackers to run malicious commands on vulnerable web servers without needing a password.

In practice, the two security flaws, identified as CVE-2026-109618 and CVE-2026-109619, lately received emergency patches. Nevertheless, researchers have now confirmed successful attacks just days after the updates were issued. Hackers Successfully Exploit PHP Flaws.

Security researcher Adel Karimi. This person works at Perplexity, discovered the attacks using special test servers designed to detect hacking attempts.

These systems, known as honeypots, allow researchers to monitor how hackers try to break into websites.

Karimi discovered that attackers successfully ran commands on test servers using PHP 8.4.26 with Apache. Firms Are Spending Billions on AI but Making No Extra Capital.

Meanwhile, the attacks additionally exposed information stored in the servers' memory. It assisted the hackers carry out further commands.

Although it remains unclear whether the same attackers were responsible, the activity came from two IP addresses. Researchers Confirm the Security Threat. Karimi explained that the attacks went beyond simply crashing vulnerable servers.

Notably, the hackers were able to access approximately 800KB of memory data and employ that information to execute commands remotely.

Cybersecurity researcher Marcus Hutchins from Expel additionally reviewed the findings and confirmed that they provided robust evidence of successful exploitation. Nevertheless, the attacks were recorded on servers with a particular configuration. ChatGPT Rival Anthropic Files for IPO After $80 Billion Loss.

Researchers have not confirmed whether the same method would work equally well against other PHP versions or server setups.

For context, the available evidence directly confirms an attack method linked to CVE-2026-109618, but does not separately establish successful exploitation of CVE-2026-109619. PHP developers have already published emergency updates to address the vulnerabilities.

Notably, the security fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Website owners using affected older versions should update their servers to protect against feasible attacks.

If successfully exploited, the flaws could allow hackers to access sensitive information, change website files, or run harmful software, depending on the permissions available on the server.

For context, the confirmed attacks show that PHP2Shell is now a real security threat rather than just a potential weakness.

Although the documented successful attacks targeted test servers, they demonstrate why website administrators need to install the latest PHP security patches. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and.

Taken together, the developments around hackers Are Now Exploiting Critical PHP Flaws to Attack Websites point to a situation that is still moving, and the coming days should bring more clarity.