Cybersecurity researchers have verified that attackers are actively exploiting PHP2Shell vulnerabilities to execute shell commands on honeypot servers. This significant development was reported by a researcher over the past weekend.
CVE-2026 Vulnerabilities and Patching
The vulnerabilities, officially recorded as CVE-2026-109618 and CVE-2026-109619, are critical issues that allow unauthenticated remote code execution. The PHP team addressed these flaws with a patch released on October 21, prompted by an online leak of exploit information.
Attempts to exploit these vulnerabilities began before the release of the patches. Despite millions of attempts, no successful code execution had been confirmed until now, although researchers had created exploits capable of bypassing Address Space Layout Randomization (ASLR) protections.
Successful Exploitation on Honeypots
Researcher Adel Karimi, from Perplexity, has been running honeypots that mimic standard PHP-backed web pages using PHP version 8.4.26 with Apache’s mod_php in a single-worker configuration. Initially, his monitoring system detected numerous out-of-memory errors and worker crashes, but no actual code execution.
However, on October 24, Karimi observed 35 shells being executed across three honeypots. Notably, one IP address was responsible for triggering three shells on a single honeypot, while another managed to launch 32 shells across all three honeypots. The attackers utilized a four-stage HTTP request chain, with some requests causing memory exhaustion and others leaking memory contents, culminating in shell command execution.
Analysis and Industry Response
Karimi’s findings indicate that this was a confirmed remote code execution with effective memory disclosure, rather than mere crashes. Despite this breakthrough, he cautioned that the exploit’s effectiveness on other configurations or PHP builds might differ.
Marcus Hutchins, a principal threat researcher at Expel, praised the findings as the strongest evidence of PHP2Shell exploitation observed in the wild to date. Meanwhile, CISA updated its PHP2Shell alert on October 23, incorporating a Sigma detection rule, but had not yet classified the vulnerabilities as known exploited vulnerabilities in their catalog by October 26.
As the cybersecurity community continues to monitor the situation, the recent developments underscore the need for vigilance and timely updates to mitigate potential risks posed by these vulnerabilities.
