Hackers exploit PHP security flaws to execute commands without passwords

Hackers are exploiting security flaws in PHP that allow attackers to run malicious commands without a password. Security researchers identified these vulnerabilities as CVE-2026-109618 and CVE-2026-109619.
Adel Karimi discovered the attacks while monitoring honeypots. Attackers ran commands on test servers using Apache and PHP version 8.4.26.
Researchers recorded 35 successful command executions on 24 October originating from two IP addresses. Hackers accessed approximately 800KB of memory data during the breach.
Marcus Hutchins from Expel confirmed evidence of successful exploitation linked to CVE-2026-109618. Evidence does not separately establish successful exploitation of CVE-2026-109619.
PHP developers released emergency updates to address the security flaws. Security fixes are now available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.























