Researcher confirms PHP2Shell flaws exploited in the wild

Attackers have used the PHP2Shell vulnerabilities to run shell commands on decoy servers. The researcher who caught the activity described it as confirmed remote code execution, a step beyond the scanning and crashes reported earlier. Before this, security firms had recorded millions of exploitation attempts since the flaws became public last week, but none had confirmed that code actually ran, SecurityWeek reported.securityweek.com

Honeypots record 35 shells

Adel Karimi, a researcher at Perplexity, runs honeypots that serve ordinary PHP-backed pages. They use PHP 8.4.26 under Apache mod_php with a single worker. His first report covered just over 26 hours and logged 30 out-of-memory errors and 11 worker crashes, with no code execution. On October 24, however, his sensors recorded 35 shells across three honeypots. One IP address produced three shells and another spawned 32, according to SecurityWeek.securityweek.com

The attackers used a four-stage chain of HTTP requests. The first requests exhausted PHP's memory, the next leaked memory contents, and the last ran a shell command. The traffic closely matched a public proof-of-concept exploit for CVE-2026-109618, and no second-stage payload was downloaded. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process," Karimi said. He added that the shell command ran about 1.6 milliseconds after the final request.bleepingcomputer.com+1

Karimi warned that his setup was "intentionally favorable" and does not measure how reliable the exploit is on other configurations. Expel researcher Marcus Hutchins called the findings "by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I've seen so far". As of the morning of October 26, CISA had not added the flaws to its Known Exploited Vulnerabilities catalog.securityweek.com

Patched after a leak

Both flaws are rated 9.2 under CVSS 4.0 and allow unauthenticated attackers to execute code by corrupting PHP's internal memory when request handling fails. PHP fixed them on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Beazley Security. PHP moved the release forward a day after the CVE identifiers leaked on Hacker News. Amazon recorded an exploitation attempt on October 17, four days before disclosure. As of October 23, more than 34.4 million PHP services were still assessed as vulnerable.labs.beazley.security+3

AI's "Black October"

Researchers at Wiz and Calif found the flaws in August using AI models from OpenAI and Google, CNBC reported. The wave of AI-discovered bugs has been dubbed "Black October," and some organizations took their websites offline while they patched. Investors bet the episode would increase spending on security. Shares of Okta ↗ 3.27%, Palo Alto Networks ↗ 2.60% and CrowdStrike ↗ 1.65% rallied last week, according to Zacks via The Globe and Mail. Still, Arctic Wolf has reported "comparatively little evidence of reliable exploitation at scale".theglobeandmail.com+3