PHP2Shell Security Flaws Now Successfully Exploited

PHP2Shell's critical vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) have now been successfully exploited in the wild, just days after patches were released, according to BleepingComputer. This real‑world breach demonstrates that attackers are actively scanning for unpatched PHP2Shell installations and using the flaws to execute arbitrary commands on vulnerable servers. For website owners, the immediate risk is a surge in automated bot traffic attempting to locate and exploit these specific PHP2Shell endpoints. Even sites that have applied the latest patches can be targeted by bots that first probe for the presence of the vulnerable script before attempting a payload. Unpatched legacy sites, shared hosting environments, or misconfigured backups that still contain the old PHP2Shell code are especially exposed, potentially leading to data theft, defacement, or server takeover. **Actionable steps:** 1. **Update your llms.txt** to explicitly block known PHP2Shell exploitation patterns (e.g., `User‑Agent: *php2shell*` and common query strings like `?cmd=`) and whitelist only trusted crawlers. 2. Deploy a real‑time bot‑detection rule in your WAF that flags requests to `/php2shell*` paths or to files matching the vulnerable script names, then automatically drop or challenge them. 3. Conduct a rapid inventory scan of all hosted directories for remnants of PHP2Shell files and remove or replace them, then re‑crawl the site with llms.txt to verify that no unauthorized AI bots are accessing the cleaned URLs.