Security researchers and U.S. government authorities have seen what appears to be the first successful exploitation of critical vulnerabilities in PHP.
For more than a week, hackers have attempted to exploit a memory-corruption vulnerability, tracked as CVE-2026-109618, and a stale internal request-state vulnerability, tracked as CVE-2026-109619.
Researchers at Perplexity uncovered the first successful exploitation of the vulnerabilities. Perplexity said honeypot sensors detected the activity, and that a threat actor had achieved remote-code execution (RCE).
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Adel Karimi, detection and response lead at Perplexity, said in a post on X.
Marcus Hutchins, principal threat researcher at Expel, backed up the findings by Karimi, noting the research was the “highest-quality confirmation” of PHP exploitation that he had seen since the crisis began last week, according to a post on X.
Hutchins cited the technical breakdown of a successful exploitation attempt targeting an “Apache mod_php installation running PHP 8.4.26.”
The Cybersecurity and Infrastructure Security Agency on Monday added the two flaws to its Known Exploited Vulnerabilities catalog. The agency did not specify exactly what led them to update the catalog, but an agency official pointed to the criteria for active exploitation.
The PHP vulnerabilities raised alarms throughout the cybersecurity community. The scripting language powers roughly 70% of the websites across the globe.
The security research community has been under scrutiny to support earlier exploitation claims. VulnCheck researchers criticized the poor quality of proofs of concept that were widely circulated, and Shadowserver Foundation on Monday said it would not publish data on exposed instances, citing a lack of reliable information.
Shadowserver did publish end-of-life instances, currently showing 263,000 in the U.S. alone. After reaching end-of-life status, the software manufacturer no longer provides security patches and the customer must upgrade to a new version in order to receive official support.
