PHP2Shell Flaws Used to Gain Shells on Honeypot Servers

Security researchers have confirmed that PHP2Shell vulnerabilities were exploited to achieve remote code execution on honeypot servers, with attackers generating 35 shells from two IP addresses on 24 October 2026. The activity, observed by Perplexity researcher Adel Karimi, involved three honeypots and matched a four‑stage HTTP request chain that began with memory exhaustion and leakage, culminating in shell command execution.

The exploitation aligns with CVE-2026-109618 and CVE-2026-109619, and follows PHP’s October 21 patch rollout after initial information leaks. Karimi notes this constitutes confirmed RCE with usable memory disclosure, rather than a mere crash, though the observed sample is from a single, optimally configured mod_php setup (PHP 8.4.26 on Apache with one worker).

The events come after researchers had reported ongoing probes and numerous memory errors, but no confirmed code execution prior to 24 October. Expel’s Marcus Hutchins characterised the findings as the highest quality in‑the‑wild confirmation to date. CISA updated its PHP2Shell alert on 23 October to include a Sigma detection rule, but as of 26 October it had not added the flaws to its Known Exploited Vulnerabilities (KEV) catalogue.

Karimi cautioned that the evidence derives from a deliberately simple, single‑worker configuration and should not be treated as representative of exploit reliability across other PHP builds or deployments. No second‑stage payload download was observed in the analysed activity.