PHP2Shell flaws exploited in the wild, researchers report
Honeypots recorded a confirmed remote code execution against an Apache mod_php install running PHP 8.4.26, according to a Perplexity researcher whose findings a second researcher corroborated.
Two critical PHP remote code execution flaws tracked together as PHP2Shell have now been exploited successfully in the wild, according to researchers cited by BleepingComputer in an October 26 report.
Adel Karimi, detection and response lead at Perplexity, said his honeypots recorded confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. He described the response as including a large decoded cookie dump, with a function address derived from that dump using the public exploit's offsets appearing in the follow-on execution payload. Expel threat researcher Marcus Hutchins said he had confirmed the findings and called it the strongest evidence of PHP2Shell exploitation he had seen.
Earlier activity looked different. Several security companies, including Cloudflare, Hadrian, watchTowr, Previdian and Patchstack, saw exploitation attempts before public disclosure but flagged them as unsuccessful. Amazon Threat Intelligence reportedly saw targeting four days before patches shipped, which Dataminr's TRACE team described as scanning, fingerprinting and non-working exploits with no known compromises.
The PHP security team patched the flaws on Wednesday, October 21, a day after telling admins to prepare. Some proof-of-concept exploits circulated before the patches, though the PHP team said none were functional.
What defenders should do
The report does not describe a patch status for every affected version, so treat the vendor advisories as the authority. Admins running PHP should confirm their version against the vendor advisory and apply the October 21 updates where they haven't. The PHP team also advised setting session.upload_progress.enabled=0 as a mitigation for a separate unpatched RCE flaw, a setting it had already recommended before the PHP2Shell patches. Given the exposure of PHP-based web stacks, checking internet-facing mod_php deployments for signs of unexpected command execution is reasonable.
The exploitation claim rests on researcher accounts, not a vendor confirmation of compromise.
CVE references
Sources
- PHP2Shell security flaws now sucessfully exploited in the wildPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning