Attackers have successfully exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, a researcher reported over the weekend.
Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution. PHP patched them on October 21, after some information leaked online.
Exploitation attempts began before the fixes were released, and millions have been recorded since, but security firms had not confirmed any successful code execution. Researchers had, however, developed exploits capable of bypassing ASLR protections.
Perplexity researcher Adel Karimi runs honeypots that present ordinary PHP-backed pages, using PHP 8.4.26 under Apache mod_php with a single worker. His first report, covering just over 26 hours of activity, logged 30 out-of-memory errors and 11 worker crashes, but no code execution.
That changed on October 24, when Karimi’s sensors recorded 35 shells launched across three honeypots. One IP address produced three shells on a single honeypot, while another spawned 32 shells across all three.
The attackers used a four-stage chain of HTTP requests. Some requests exhausted PHP’s memory, others leaked memory contents, and the last executed a shell command. The traffic closely matched a public proof-of-concept (PoC) exploit, and the activity is consistent with exploitation of CVE-2026-109618, according to Karimi.
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” he wrote on X.
No second-stage payload download was observed.
Karimi cautioned against reading too much into the results. “The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications,” he said.
Expel principal threat researcher Marcus Hutchins described the findings as “by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I’ve seen so far.”
When CISA updated its PHP2Shell alert on October 23 to add a Sigma detection rule, it said it had not observed successful exploitation. As of the morning of October 26, the agency had not added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Related: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Related: Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
