php2shell RCE confirmed on honeypots and some network appliances
Original title: php2shell one week later: Why one exploit doesn’t work everywhere
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
Tenable says a week of testing found php2shell remote code execution usually needs an exploit fitted to a target’s PHP heap, worker reuse and memory layout. Five internet-exposed vulnerable PHP sites saw mass attempts and were not compromised through October 29. Elsewhere, researcher honeypots recorded successful shells, CISA listed both flaws, and reports describe chaining with the Fragnesia kernel bug against PAN-OS management interfaces.
Unconfirmed: Tenable has not verified Dream’s claim of 25 rooted PAN-OS servers, though Unit 42 says it confirmed the results.
- CVE-2026-109618 and CVE-2026-109619 each have a CVSSv4 score of 9.2.
- CISA added both CVEs to KEV on October 26, with a federal deadline of October 29.
- Karimi’s honeypots recorded 35 successful shells on PHP 8.4.26 under Apache mod_php.
- Dream claims 25 PAN-OS systems were rooted; Unit 42 says it verified the tooling.
- Censys counted about 30.3 million PHP services still on an affected version on October 29.
Impact: Unauthenticated remote code execution, sometimes chained to root
| Product | Affected |
|---|---|
| PHP | — |
| Palo Alto Networks PAN-OS | — |
- 1.Patch internet-facing management interfaces, network appliances and end-of-life PHP branches first.
- 2.Use Tenable Nessus or Tenable One version-based detection, available since October 21.
- Vendors
- PHPPalo Alto NetworksTenable
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
10 min read at tenable.com
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the exception: one tuned exploit can reach every device that runs it.
By Joshua Martinelle, Thomas Cappetta · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.