Researchers have successfully exploited a PHP2Shell vulnerability to execute shell commands on honeypot servers, researchers reported over the weekend.
Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaw can be exploited for unauthenticated remote code execution. PHP fixed them on October 21, after some information was leaked online.
Exploitation efforts began before the fix was released, and millions have been saved since, but the security firm has not confirmed any successful code execution. However, researchers have developed exploits capable of bypassing ASLR protection.
Perplexity researcher Adel Karimi runs honeypots that present plain PHP support functions, using PHP 8.4.26 under Apache mod_php with a single worker. His first reportCovering just over 26 hours of activity, recording 30 out-of-memory errors and 11 employee crashes, but no code execution.
That changed on October 24, when Karimi sensor record 35 shells were launched across 3 Honeypots. One IP produced a trio of snails in a single honey pot, while another laid 32 eggs across all three units.
The attacker used a four-step chain of HTTP requests. Some PHP requests run out of memory, some requests leak memory, and finally execute shell commands. The traffic closely matches the public proof of concept (PoC) exploit, and the activity is consistent with the CVE-2026-109618 exploit, according to Karimi.
“This is confirmed now RCE with the disclosure of usable memory, not just an accident that followed a suspicious process,” he Write on X.
The second stage payload download is not observed.
Karimi cautioned against reading too much into the results. “The evidence shows this chain is about a single worker mod_php profile that is deliberately favorable; it is not a measure of the reliability of exploits in the number of other workers, PHP builds, or applications,” he said.
Fire chief threat researcher Marcus Hutchins Explain The discovery is “by far the highest quality confirmation of PHP2Shell exploits in the wild that I’ve seen so far.”
When CISA updated it PHP2Shell alert On October 23rd to increase the detection rule Sigma, it said that it did not notice a successful exploit. As of the morning of October 26, the agency has not added the vulnerability to its list of known exploits (KEV).
Related: Mirai Botnet Operators Join PHP2Shell Attacks While ASLR Bypass Exploits Occur
Related: Technology and security companies respond to PHP2Shell vulnerability
Related: Node2Shell: Brotli Flaw Triggers Patching across Microsoft, Node.js, Python Packages
