Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

PHP2Shell exploit attempts rise, but experts doubt they succeed

Original title: Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits

The Record ()3 min read1 · 1 read
Read at therecord.media
Part of a story covered by 19 sourcesRansomware groups still exploit patched Palo Alto GlobalProtect flawMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.

Attempted exploitation of CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, has drawn reports from large companies, including Amazon observations dating to October 17. Sophos retracted a claim of successful exploitation, and Google’s John Hultquist said his team has not validated in-the-wild exploitation. Researchers say circulating PoCs mostly work in lab conditions and stall on ASLR. Censys counted more than 41 million internet-facing PHP services on affected versions as of October 22. Experts still urge patching.

Unconfirmed: Successful exploitation is unconfirmed; Sophos retracted a success claim, and experts disagree on what reported attempts mean.

Key facts
  • Sophos later said it saw only a small number of failed attempts.
  • Arctic Wolf linked attempts to Potassium; Cobalt tied some to Mirai.
  • VulnCheck says it built an ASLR bypass not seen in public exploits.
  • Hutchins reported a scanner finding reachable unpatched PHP systems.
  • About 1 million services were running a fixed release, Censys said.
Security assessment · AI, from the articlePublic proof of concept

Impact: Attempted remote exploitation to install botnet malware

ProductAffected
PHP—
What to do
  1. 1.Patch vulnerable PHP systems before a reliable exploit becomes available.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618CVE-2026-109619
ATT&CK
T1190 Exploit Public-Facing ApplicationT1595.002 Vulnerability Scanning
Tags
phpphp2shellbotnetmiraiaslr
Products
PHP
Malware
PotassiumMirai
Organizations
AmazonSophosArctic WolfCobaltVulnCheckCensysExpel

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109619
+1 related CVE
CVE-2026-109618
Use-after-free RCE in PHP via stale request globals
9.2100%PoC ×13

From the original article

3 min read at therecord.media

The headline-grabbing bugs known colloquially as PHP2Shell are giving cyber analysts a lot to track — and a lot to debunk.

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.