PHP2Shell security flaws now sucessfully exploited in the wild

Two critical remote code execution vulnerabilities in PHP 8.4.26 (CVE-2026-109618 and CVE-2026-109619) have moved from theoretical risk to confirmed in-the-wild exploitation, including memory disclosure, despite patches being available from the PHP security team. The root cause is straightforward: organisations running Apache mod_php installations failed to apply available security fixes before threat actors weaponised working exploits. This pattern — where initial scanning activity escalates to successful exploitation — is a well-documented threat actor playbook that relies on defender inertia. The fact that patches existed at the time of confirmed exploitation means every affected organisation that was breached could have avoided the incident entirely through timely patch deployment. This matters because RCE with memory disclosure can cascade into credential theft, lateral movement, and full infrastructure compromise.