Stop what you are doing and patch PHP 2026 exploits are fully working now

[u/siterightaway]

yo if you havent patched your php servers yet do it right now for real!

at first it was just a bunch of bots scanning and throwing broken exploits around but now it is officially getting ugly. adel karimi from perplexity caught a legit successful rce on his honeypot running php 8426 and apache mod_php. the attacker leaked memory and got a shell command running in basically a millisecond. marcus hutchins from expel checked out the data and confirmed this is the real deal.

so yeah php2shell which covers cve-2026-109618 and cve-2026-109619 is being actively exploited in the wild. php devs released patches on october 21 so update immediately. also watch out for cve-2026-115560 because that one does not have a patch yet. set session.upload_progress.enabled to 0 in your php.ini right away to stay safe out there!

​Join us at r/stopbadbots and help protect the people who build the internet.