PHP2Shell Exploitation Moves From Probes to Working Shells
Attackers have successfully exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, a researcher reported over the weekend.
Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution. PHP patched them on October 21, after some information leaked online.
Exploitation attempts began before the fixes were released, and millions have been recorded since, but security firms had not confirmed any successful code execution. Researchers had, however, developed exploits capable of bypassing ASLR protections.
Perplexity researcher Adel Karimi runs honeypots that present ordinary PHP-backed pages, using PHP 8.4.26 under Apache mod_php with a single worker. His first report, covering just over 26 hours of activity, logged 30 out-of-memory errors and 11 worker crashes, but no code execution.
That changed on October 24, when Karimi’s sensors recorded35 shells launched across three honeypots. One IP address produced three shells on a...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
