Confirmed PHP2Shell exploitation has now resulted in remote code execution in the wild, according to newly published honeypot evidence. The findings mark a shift from earlier scanning and failed attempts to a successful attack.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, received emergency patches on October 21. However, researchers have now documented a successful attack against an Apache mod_php installation running PHP 8.4.26.
Honeypot Evidence Confirms PHP2Shell Exploitation
Adel Karimi, detection and response lead at Perplexity, captured the malicious activity through a honeypot system. His analysis linked a successful memory leak to a subsequent command execution request.
The server returned approximately 800 KiB of decoded cookie data. According to Karimi, the attacker then used information from that response to construct the execution payload.
Specifically, a function address calculated from the leaked data appeared in the later request. That connection provided stronger evidence than a server crash or an unexpected process alone.
The captured traffic also showed that the client acknowledged the full response. Around 1.6 milliseconds after the final captured byte of the execution request, the shell command ran.
Expel threat researcher Marcus Hutchins reviewed the findings and described them as strong confirmation of successful exploitation.
Earlier Attacks Failed to Demonstrate Compromise
Before these findings, security companies had observed attempts to exploit PHP2Shell without confirming successful compromises.
Cloudflare, Hadrian, watchTowr, Previdian and Patchstack detected malicious activity before public disclosure. However, they assessed the attempts they observed as unsuccessful.
Meanwhile, Amazon Threat Intelligence identified attacks targeting the vulnerabilities four days before the emergency patches arrived.
Dataminr’s threat research team previously characterised the activity as scanning, fingerprinting and attempts involving non-working exploits. At that stage, researchers had not established any known compromises.
The new honeypot evidence changes that assessment by demonstrating a working attack against a specific server configuration. However, it does not establish how many production systems attackers may have compromised.
Emergency Patches Followed an Early Information Leak
The PHP security team released fixes for both PHP2Shell vulnerabilities on October 21. One day earlier, it urged administrators to prepare for immediate updates.
Details circulated online before the patches became available. These included vulnerability identifiers and mitigation guidance that some critical infrastructure providers had received.
Several proof-of-concept exploits also appeared during that period. However, the PHP security team said those early examples did not work.
Administrators should therefore distinguish the unsuccessful early attempts from the newly confirmed exploitation. The latest evidence increases the urgency of applying the PHP2Shell security updates.
Separate PHP Flaw Requires a Temporary Mitigation
Alongside PHP2Shell, the PHP security team disclosed mitigation guidance on October 23 for another remote code execution vulnerability, CVE-2026-115560.
According to the report, that separate flaw remained unpatched as of October 26. Exploitation requires an unusual combination of server configuration and application code.
Until a fix becomes available, PHP developers advise administrators to disable session upload progress through this setting:
session.upload_progress.enabled=0
The team had also recommended this measure before releasing the PHP2Shell patches. However, administrators should apply the available security updates for the original two vulnerabilities rather than rely solely on temporary mitigation.
PHP’s Wide Deployment Raises the Stakes
PHP powers a substantial share of websites, making vulnerabilities in the language relevant across a broad range of hosting environments.
Recent VirusTotal estimates identified more than 5.1 million internet-exposed PHP hosts. Of those, approximately 3.8 million had at least one open port potentially available to attackers.
Those figures describe exposure, rather than confirmed vulnerability or compromise. Nevertheless, the successful PHP2Shell exploitation shows why administrators should promptly review their deployments and install the available fixes.
0 responses to “PHP2Shell Exploitation Confirmed in Live Attacks”