Researchers confirm PHP2Shell working shells in honeypots

On October 24, security researcher Adel Karimi confirmed 35 working shells on his PHP-based honeypots, marking the first confirmed code execution for the critical PHP2Shell vulnerabilities. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, permit unauthenticated remote code execution and server takeover on PHP versions reaching back to version 5.4. Researchers at Calif and Google Cloud’s Wiz discovered the flaws in August, working with OpenAI’s Patch the Planet project, and PHP patched them on October 21 after details leaked online on October 20.

Karimi’s honeypots, which run ordinary PHP pages on PHP 8.4.26 with Apache mod_php and one worker, recorded the 35 shells across three sensors. A single IP address generated three shells on one honeypot, while another IP address generated 32 shells across all three honeypots. Karimi linked the observed activity to exploitation of CVE-2026-109618.

The attack chain involved four HTTP requests that exhausted PHP memory, leaked memory contents, and executed a shell command. The observed exploit traffic closely resembled a publicly available proof-of-concept exploit for PHP2Shell, and no second-stage payload download was observed during the shell activity. Karimi wrote on X, “This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process.” In an earlier 26-hour report, the honeypots recorded 30 memory exhaustion errors and 11 worker crashes without any code execution.

Before Karimi’s October 24 report, security firms had not confirmed any working code execution despite millions of attempts. Amazon Threat Intelligence confirmed a PHP2Shell exploitation attempt on October 17 in its MadPot honeypot system, four days before patches were released, from an IP tied to a commercial anonymization network. Cloudflare CEO Matthew Prince said Cloudflare saw thousands of exploit attempts in the ten hours before disclosure, rising to millions afterward.

Amazon researchers identified multiple proof-of-concept exploits on October 21, around 12 hours before scheduled disclosure, with the earliest detected at approximately 2am GMT. The PHP security team confirmed that pre-patch proof-of-concept exploits were not functional. Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack observed failed attempts prior to disclosure, and Dataminr TRACE said post-disclosure activity on October 22 remained limited to scanning, fingerprinting and non-working exploits with no confirmed compromises. Other firms also observed exploitation attempts for both flaws.

Further proof-of-concept exploits emerged within hours of the release of the PHP2Shell patches and were used against Amazon’s sensors almost immediately, and independent researchers and security experts published proof-of-concept exploits for unpatched PHP versions. Amazon said attackers deployed multiple proof of concept exploits hours after disclosure from VPN IP addresses. Amazon researchers indicate that exploitation is now occurring widely in real-world environments, though the number of successful attacks remains unclear. Amazon’s chief information security officer, CJ Moses, advises that defenders should not assume exploitation began only on the public disclosure date, noting that observed attacks used varied payloads and anonymization methods suggesting multiple threat actors.

CYFIRMA assigned moderate confidence to a Korean-speaking operator in the Lazarus Group ecosystem for a suspected North Korea PHP2Shell campaign, which uses 21 compromised nodes and targets 216 unpatched or partially mitigated hosts across government, finance, logistics, aviation, manufacturing, and online platforms. CYFIRMA reports the scanning is low-volume and slow, with nodes rotated and abandoned if blocking or rate-limiting is detected, and the campaign has shifted to deliberate, slow-paced scanning of filtered targets, focusing on high-priority sectors and regions. CYFIRMA CEO Kumar Ritesh stated, “Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it.”

Defused Cyber said on October 25 that it is seeing PHP2Shell probes from IP address 204.76.203.7 targeting its GlobalProtect honeypots. Unit 42 withdrew its earlier claim that a European government agency compromise resulted from PHP2Shell exploitation, stating it cannot confirm initial access is tied to the specific CVEs. However, Unit 42 observed attackers using agentic AI platforms for post-exploitation, gaining password hashes and multifactor authentication secrets within two hours of attacking a European government agency’s vulnerable PHP application, and observed an NTLM-relay tunnel into Active Directory with an attempted Domain Admin privilege escalation.

ReliaQuest reproduced CVE-2026-109618 in a lab and identified a detection sequence of POST request returning 500, PHP memory exhaustion and heap corruption, and Apache worker crash, and Datadog said exploiting the flaws requires forcing memory allocation failure at the right moment and defeating ASLR to find valid memory addresses. Xint released a scanner to check host exposure to PHP2Shell. On October 23, CISA added a Sigma detection rule to its PHP2Shell alert while stating it had not seen successful exploitation, and as of October 26 morning, CISA had not placed the flaws in its Known Exploited Vulnerabilities catalog. Cloudflare states that its web application firewall services automatically protect customers from the PHP2Shell vulnerability.

PHP powers up to 80 percent of all websites on the Internet, including content management systems such as WordPress, Drupal and Joomla, and W3Techs data puts PHP usage at approximately 69.7 percent of websites with a known server-side programming language. Bitsight internet-wide scans found nearly 37 million systems running PHP or PHP-related software, with most exposure in the U.S., Germany, France, the Netherlands and Japan. VirusTotal data shows over 5.1 million exposed PHP hosts online, about 3.8 million of them with at least one open port. PHP released fixed versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, stating that updating is the only complete solution to address the two vulnerabilities, and only supported PHP branches version 8.2 and later receive official patches; PHP 8.1 and earlier releases will not be fixed.

The UK National Cyber Security Centre told UK organizations to update PHP servers immediately or take them offline before patching. French public administrations, the Dutch National Cyber Security Centre and the University of Vienna took websites offline before patching. PHP core developer Gina Peter Banyard said before disclosure that only applying the official patches provides a permanent defense. The PHP Foundation warned of a third remote code execution flaw, CVE-2026-115560, that happens only under uncommon configuration and application code conditions, requiring specific session.serialize.handler settings.