PHP2Shell Exploitation Moves From Probes to Working Shells

The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on PHP servers. After PHP released patches on October 21, 2026, attackers successfully exploited these flaws against honeypots on October 24, launching 35 shells from two IP addresses. The exploitation involved a four-stage HTTP request chain causing memory exhaustion, memory leaks, and ultimately shell command execution. This confirms real-world remote code execution beyond prior crash-only observations. The exploit closely matches a public proof-of-concept and bypasses ASLR protections. While confirmed on a specific PHP configuration, broader exploit reliability remains unmeasured. As of October 26, CISA had not observed confirmed exploitation in the wild or added these vulnerabilities to its KEV catalog.

• securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells/ (opens in a new tab)

• Red Hat Security Advisory: php security updateExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php security updateExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php security updateExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php:8.2 security updateExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php:7.4 security updateExploitedVulnerability2026-10-23