Attackers are successfully exploiting the PHP2Shell security flaws in real-world conditions, moving beyond earlier probing to deploy functioning post-exploitation activity. SecurityWeek reports that exploitation against honeypots resulted in “working shells,” with 35 shells launched from two IP addresses on October 24.
Bleeping Computer similarly says two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619—are being exploited in the wild. The Hacker News adds that threat actors use “agentic” AI platforms for post-exploitation, and reports an incident in which a government entity in Europe is targeted; it also says attackers obtain sensitive data such as password hashes and are able to access systems within a short window after exploitation.
Across the reports, all outlets focus on the same PHP2Shell vulnerabilities and confirm real exploitation. Differences mainly concern what details are included—such as honeypot shell counts, the presence of AI-assisted post-exploitation, and the type of victim organization mentioned.
