Attackers have successfully exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, a researcher reported over the weekend.
Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution. PHP patched them on October 21, after some information leaked online.
Exploitation attempts began before the fixes were released, and millions have been recorded since, but security firms had not confirmed any successful code execution. Researchers had, however, developed exploits capable of bypassing ASLR protections.
Perplexity researcher Adel Karimi runs honeypots that present ordinary PHP-backed pages, using PHP 8.4.26 under Apache mod_php with a single worker. His first report, covering just over 26 hours of activity, logged 30 out-of-memory errors and 11 worker crashes, but no code execution.
That changed on October 24, when Karimi’s sensors recorded 35 shells launched across three honeypots. One IP address produced three shells on a single honeypot, while another spawned 32 shells across all three.
The attackers used a four-stage chain of HTTP requests. Some requests exhausted PHP’s memory, others leaked memory contents, and the last executed a shell command. The traffic closely matched a public proof-of-concept (PoC) exploit, and the activity is consistent with exploitation of CVE-2026-109618
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” he wrote on X.
No second-stage payload download was observed.
Karimi cautioned against reading too much into the results. “The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,” he said.
Expel principal threat researcher Marcus Hutchins described the findings as “by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I’ve seen so far.”
When CISA updated its PHP2Shell alert on October 23 to add a Sigma detection rule, it said it had not observed successful exploitation. As of the morning of October 26, the agency had not added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Related Content
Vulnerabilities
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.
Vulnerabilities
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
Vulnerabilities
Attackers Exploit Third Arista VCO Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
Vulnerabilities
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
Mobile & Wireless
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Incident Response
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.
Vulnerabilities
Splunk, SolarWinds Release Fresh Security Updates
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.
Vulnerabilities
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
