Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

PHP2Shell Exploitation Moves From Probes to Working Shells

Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.

By

Eduard Kovacs

| October 26, 2026 (9:30 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Attackers have successfully exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, a researcher reported over the weekend.

Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution. PHP patched them on October 21, after some information leaked online.

Exploitation attempts began before the fixes were released, and millions have been recorded since, but security firms had not confirmed any successful code execution. Researchers had, however, developed exploits capable of bypassing ASLR protections.

Perplexity researcher Adel Karimi runs honeypots that present ordinary PHP-backed pages, using PHP 8.4.26 under Apache mod_php with a single worker. His first report, covering just over 26 hours of activity, logged 30 out-of-memory errors and 11 worker crashes, but no code execution.

That changed on October 24, when Karimi’s sensors recorded 35 shells launched across three honeypots. One IP address produced three shells on a single honeypot, while another spawned 32 shells across all three.

The attackers used a four-stage chain of HTTP requests. Some requests exhausted PHP’s memory, others leaked memory contents, and the last executed a shell command. The traffic closely matched a public proof-of-concept (PoC) exploit, and the activity is consistent with exploitation of CVE-2026-109618, according to Karimi.

Advertisement. Scroll to continue reading.

“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” he wrote on X.

No second-stage payload download was observed.

Karimi cautioned against reading too much into the results. “The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,” he said.

Expel principal threat researcher Marcus Hutchins described the findings as “by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I’ve seen so far.”

When CISA updated its PHP2Shell alert on October 23 to add a Sigma detection rule, it said it had not observed successful exploitation. As of the morning of October 26, the agency had not added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

Related: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Related: Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Written ByEduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Eduard Kovacs

  • Atlassian Patches 75 Flaws in Data Center and Server Products
  • Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
  • Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  • Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
  • Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
  • OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
  • Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
  • Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

Latest News

  • 953 Online Stores Infected in Long-Lasting Malware Campaign
  • Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
  • Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
  • Mythos 5 Ignored Real-World Harm in July Attack
  • Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
  • In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
  • Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  • China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Trending

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024

Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

Atlassian Patches 75 Flaws in Data Center and Server Products

Attackers Exploit Third Arista VCO Zero-Day in Four Months

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Cequence Security has appointed Russ Schafer as CMO.

Mona Harrington has been named Assistant Director for Cyber Integration at DHS.

iCOUNTER has appointed Mark H. FitzPatrick as CFO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)

Four Cyber Threats Harboring Big Plans for the Future

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)

Begin at the End: How to Enable Agentic Remediation

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)