PHP2Shell security flaws now sucessfully exploited in the wild

Two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, have been actively exploited in the wild. The vulnerabilities are classified as critical severity and allow attackers to execute arbitrary code remotely. Security researchers have confirmed successful exploitation attempts against affected systems. The dual CVEs are being tracked together under the PHP2Shell collective name, suggesting a coordinated or related attack surface. Organizations running affected PHP2Shell installations are urged to apply patches or mitigations immediately given the confirmed in-the-wild exploitation status.