PHP2Shell Exploitation Moves From Probes to Working Shells

What it is

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, critical PHP flaws that allow unauthenticated remote code execution. PHP patched them on 21 October 2026, after some details leaked online. Exploitation attempts began before the fixes shipped, and millions have been recorded since. Until 24 October, security firms had not confirmed any successful code execution.

How it works

Perplexity researcher Adel Karimi's honeypots served ordinary PHP-backed pages on PHP 8.4.26 under Apache mod_php with a single worker. Their first report covered just over 26 hours and logged 30 out-of-memory errors and 11 worker crashes, but no code execution. On 24 October the sensors recorded 35 shells across three honeypots. One IP address produced three shells on one honeypot, and another produced 32 across all three.

The attackers sent a four-stage chain of HTTP requests. Some exhausted PHP memory, others leaked memory contents, and the last ran a shell command. The traffic closely matched a public proof-of-concept exploit. Karimi described it as confirmed RCE with usable memory disclosure. The page notes that researchers had already built exploits that bypass ASLR.

Preconditions / Affected

The confirmed case is PHP 8.4.26 with Apache mod_php and a single worker. The page does not list other affected versions or the patched version numbers.

What to do

The page states only that PHP released fixes on 21 October 2026. CISA updated its PHP2Shell alert on 23 October to add a Sigma detection rule. As of the morning of 26 October, CISA had not added either CVE to its Known Exploited Vulnerabilities catalog, so do not wait for a KEV listing to prioritise patching.

Caveats

Karimi says the evidence covers this chain on an "intentionally favorable single-worker mod_php profile" and does not measure reliability on other worker counts, PHP builds or applications. No second-stage payload download was observed. CISA said on 23 October that it had not observed successful exploitation. Marcus Hutchins of Expel called the findings "by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I've seen so far."