PHP2Shell exploitation confirmed with working shells on honeypots
Original title: PHP2Shell Exploitation Moves From Probes to Working Shells
Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots; CISA had not added the flaws to KEV.
A Perplexity researcher said attackers used PHP2Shell to run shell commands on three honeypots on October 24. CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution; PHP patched them on October 21 after details leaked. Traffic matched a public proof of concept and was consistent with CVE-2026-109618. CISA said on October 23 it had not seen successful exploitation and, as of October 26 morning, had not listed the flaws in KEV.
Unconfirmed: Karimi ties the activity to CVE-2026-109618 and says it was shown only on a favorable single-worker mod_php profile, not other builds.
- One IP spawned 32 shells across all three honeypots; another produced three on one honeypot.
- The chain used four HTTP stages: memory exhaustion, memory leaks, then a shell command.
- No second-stage payload download was observed.
- Earlier 26-hour monitoring logged 30 out-of-memory errors and 11 crashes, but no code execution.
- Karimi said results apply only to a single-worker Apache mod_php setup.
Impact: Unauthenticated remote code execution via shell commands
| Product | Affected |
|---|---|
| PHP | — |
- 1.Apply the PHP patches released on October 21 for CVE-2026-109618 and CVE-2026-109619.
- Vendors
- PHP
- Organizations
- CISAExpelPerplexity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at securityweek.com
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24. The post PHP2Shell Exploitation Moves From Probes to Working Shells appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.