SOCRADAR Threat Intelligence Unit researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed via an open, unauthenticated directory listing. The central asset is a lab-tested PHP2Shell remote code execution chain targeting PHP 8.4.26 running under Apache mod_php, with the operator assembling the tooling to run a shell command after a three-step HTTP-based process.
The collection also includes companion scripts that screen live websites for the conditions the chain relies on, including PHP version, server setup, and session settings. In total, screening covered public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China. While the operator’s lab tooling demonstrates feasibility, SOCRadar observed no shell access on any of the sites probed, and none met the exploit’s preconditions.
The exposed server held a lab-built exploit chain named aslr_exploit.py, described as a “one-click” PHP2Shell exploit for PHP 8.4.26 on Apache mod_php. It recycles the target PHP worker, leaks memory addresses via the session cookie to defeat ASLR, and uses PHP’s session upload progress handling to execute a shell command. The operation hinges on a debug-like environment with visible errors, weak session settings, and tight resource limits, typical of non-production configurations.
Three scripts—php2shell_fp.py, deep_probe.py, and wp_attack.py—facilitate target fingerprinting, precondition probing, and WordPress reconnaissance, with results indicating that six sites ran PHP 8.4 releases older than the fixed version, four on 8.4.26, and others on 8.3, 8.2, or EOL 5.6; none displayed exploitable conditions. Defenders are advised to update PHP (to 8.5.12, 8.4.27, 8.3.36, or 8.2.35), harden settings, and monitor for screening traffic and MARKER__ probes.
The assessment attributes moderate confidence to CVE-2026-109618, based on the observed focus on PHP 8.4.26 and session-upload-progress usage, with no confirmed shell access to date.