PHP2Shell Vulnerabilities Trigger Active Exploits
Threat actors have escalated attacks against PHP servers worldwide. Specifically, malicious campaigns targeting PHP2Shell vulnerabilities transitioned from broad network scanning to confirmed command execution. Research honeypots captured thirty-five successful command shell executions across three isolated servers. Furthermore, forensic specialists reconstructed the complete exploitation chain from network packets and system logs. Meanwhile, offensive security researchers discovered a third unpatched vulnerability within the core PHP interpreter.
Anatomy of PHP2Shell Memory Flaws
The primary threat centers on CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry an elevated CVSS score of 9.2. Specifically, these memory corruption defects reside directly inside the PHP core interpreter. The first flaw triggers internal corruption during out-of-memory states. The second defect involves a use-after-free condition during object lifecycle handling. Consequently, unauthenticated adversaries can execute arbitrary commands on vulnerable hosts. Crucially, Apache mod_php environments execute this malicious payload before web application code initializes. Therefore, updating content management platforms like WordPress or Drupal cannot eliminate this threat.
Empirical Honeypot Evidence Confirms Remote Execution
Security researcher Adel Karimi published the first definitive evidence of active remote exploitation. As detailed in a technical honeypot telemetry report, three specialized servers captured thirty-five unauthorized shell spawns. These compromised instances operated under Apache mod_php alongside PHP version 8.4.26. Specifically, forensic logs recorded thirty-two attacks originating from IP 162.35.99.94. Another three intrusions stemmed from IP address 15.204.59.70.
Attackers executed a coordinated four-stage intrusion sequence. First, crafted HTTP requests induced acute memory pressure inside the PHP engine. Second, the server leaked internal memory fragments through an expanded session identifier. Third, adversaries extracted internal memory addresses to craft the final execution payload. Ultimately, the server spawned a command shell within 1.6 milliseconds of receiving the payload. According to investigative coverage by SC World, security analysts consider these artifacts conclusive proof of in-the-wild execution. However, these successful attacks occurred within single-worker research environments rather than complex production clusters.
Surging Reconnaissance and Pre-Disclosure Exploitation
Global malicious scanning activity expanded rapidly following the initial disclosure. For instance, the Delft Threat Intelligence Lab recorded over 50,000 hostile probes within hours. These requests originated from more than 600 IP addresses spanning seventy countries. Moreover, 171 unique sources delivered weaponized payloads rather than basic reconnaissance probes. Notably, threat actors initiated attacks prior to official patch availability. According to Amazon Threat Intelligence findings, automated honeypots observed exploitation attempts four days before public disclosure.
Emerging ASLR Bypasses and Nation-State Campaigns
Security researchers rapidly developed sophisticated exploit techniques to defeat operating system mitigations. Specifically, an exploit analysis by VulnCheck demonstrated reliable command execution against systems enforcing Address Space Layout Randomization. Their functional exploit targets PHP 8.4 and 8.5 releases across AMD64 and ARM64 architectures. Furthermore, the exploit operates reliably even when administrators disable public PHP error reporting.
Meanwhile, enterprise defenders investigated several false initial alarms. For example, a security advisory update by Unit 42 retracted earlier claims linking a government intrusion to PHP2Shell. In another development, an investigation by Arctic Wolf identified automated attempts to deploy the Potassium botnet. Additionally, a threat advisory published by CYFIRMA highlighted a suspected North Korean campaign profiling 216 enterprise targets globally.
Staggering Unpatched Exposure and Mitigation Guidance
Global scanning surveys reveal massive exposure across the public web. According to a telemetry report from OX Security, 99.3 percent of measurable PHP installations remained unpatched twenty-four hours after release. Similarly, a research bulletin from Qualys revealed that 71 percent of monitored enterprise packages belong to unsupported legacy branches. Compounding these risks, developers disclosed CVE-2026-115560 as an additional unpatched remote code execution vulnerability. Administrators can temporarily mitigate this third flaw by disabling the session upload progress setting.
Ultimately, organizations must upgrade to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 immediately. System administrators must also restart Apache or PHP-FPM daemons to purge vulnerable shared libraries from memory. Additionally, security teams should inspect historical server logs for abnormal memory exhaustion events dating back to October 17. Applying official patches remains the only guaranteed defense against persistent operational compromise.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
