Marcus Hutchins (@MalwareTechBlog) on X

What it is

A thread by Marcus Hutchins (MalwareTech) on X saying that many public "php2shell" proofs of concept for CVE-2026-109618 and CVE-2026-109619 are LLM hallucinations. They do not exploit those CVEs.

How it works

Hutchins says people give an LLM loose details of the CVEs. The model latches onto the string PHP_SESSION_UPLOAD_PROGRESS and writes PHP session poisoning code instead. Session poisoning is a known technique for exploiting local file inclusion (LFI) bugs in PHP applications, not a flaw in PHP itself. Hutchins traces the pattern to a 2018 blog post by Orange Tsai on an LFI attack vector. The only link to the CVEs is the shared upload progress feature.

What to do

• Treat any "php2shell" PoC built on "session poisoning + LFI" as probably not a working exploit for these CVEs. Hutchins reports one such repository on GitHub with over 100 stars.
• Do not accept AI-assisted triage as proof of exploitation. Hutchins says some researchers' LLM triage of honeypot hits confirmed mass exploitation, and that none is currently occurring (as of the thread).
• Mitigation, which Hutchins says applies to both CVEs, is to set session.upload_progress.enabled to Off.

Caveats

• The thread gives no technical detail of the real bug beyond saying it is very difficult to exploit. Hutchins has seen it work on only a handful of PHP versions with highly specific configurations, and names neither the versions nor the settings.
• The "no mass exploitation" claim rests on Hutchins' own honeypot network and observations, with no data shown in the text.
• Hutchins calls themselves mediocre at exploit development and bases the judgement on contact with skilled exploit developers, not a published analysis.