Critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are now being exploited in the wild. This confirms earlier suspicions after patches were released. Adel Karimi of Perplexity detected the malicious activity on his honeypots. His findings demonstrate confirmed remote code execution against an Apache mod_php installation. The exploitation led to a significant 800 KiB decoded cookie dump. A function address derived from this dump was used in a subsequent execution payload. This specific chain was observed on a single-worker mod_php profile. Karimi emphasized this doesn't guarantee reliability across all configurations. Marcus Hutchins, a threat researcher, corroborated Karimi's findings. He hailed this as the most definitive confirmation of in-the-wild PHP2Shell exploitation to date.