PHP2Shell flaws move from probes to working shells on honeypots

Attackers have exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, according to Perplexity researcher Adel Karimi, who reported the results over the weekend.

The two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. PHP patched them on October 21, after some information leaked online. Exploitation attempts began before the fixes and millions have been recorded since, but security firms had not confirmed successful code execution until now.

Karimi's honeypots present ordinary PHP-backed pages, running PHP 8.4.26 under Apache mod_php with a single worker. His first report, covering just over 26 hours, logged 30 out-of-memory errors and 11 worker crashes but no code execution. On October 24, his sensors recorded 35 shells across three honeypots. One IP address produced three shells on a single honeypot; another spawned 32 across all three.

The attackers used a four-stage chain of HTTP requests: some exhausted PHP's memory, others leaked memory contents, and the last executed a shell command. Karimi said the traffic closely matched a public proof-of-concept exploit and is consistent with exploitation of CVE-2026-109618. No second-stage payload download was observed.

Karimi cautioned that the evidence shows the chain on an intentionally favorable single-worker mod_php profile, not exploit reliability on other worker counts, PHP builds or applications. Expel principal threat researcher Marcus Hutchins called it "by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I've seen so far."

CISA had not observed successful exploitation when it updated its PHP2Shell alert on October 23 to add a Sigma detection rule, and as of the morning of October 26 it had not added the flaws to its Known Exploited Vulnerabilities catalog.

For defenders, the practical step is to confirm which PHP versions are running in production and apply the vendor's fixes, then watch for memory-exhaustion patterns followed by unusual process activity on PHP workers.

CVE references

CVE-2026-109618

CVE-2026-109619