PHP2Shell Attackers Confirmed Running Commands on Honeypots

Attackers exploited the PHP2Shell vulnerabilities to run shell commands on three honeypot servers on October 24, according to Perplexity researcher Adel Karimi. The activity is the first confirmed evidence of successful in-the-wild remote code execution linked to the flaws.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute code remotely. PHP released fixes on October 21 after information about the flaws leaked online. Exploitation attempts began before the patches were available, and security companies have recorded millions of attempts since then.

Karimi’s honeypots hosted ordinary PHP-backed pages running PHP 8.4.26 with Apache mod_php and a single worker. On October 24, two IP addresses launched 35 shells across the three servers. One address launched three shells on one honeypot, while the other launched 32 across all three.

The attacks used a four-stage sequence of HTTP requests. Some requests consumed PHP memory, while others exposed memory contents. The final request ran a shell command on the server. The traffic closely matched a publicly available proof-of-concept exploit and was consistent with exploitation of CVE-2026-109618.

“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Karimi wrote on X. No follow-on payload was downloaded after the shells were launched.

Karimi cautioned that the results do not show how reliably the exploit works against all PHP configurations. The honeypots used a single-worker mod_php setup, and exploitation may produce different results with other worker counts, PHP builds or applications.

Expel principal threat researcher Marcus Hutchins described the findings as the strongest confirmation of PHP2Shell exploitation in the wild that he had seen.

Before the October 24 activity, researchers had reported crashes, memory exhaustion and exploits that could bypass address space layout randomization protections. Security companies had not confirmed successful command execution. During Karimi’s first observation, which covered more than 26 hours, his sensors recorded 30 out-of-memory errors and 11 worker crashes without evidence of shell execution.

The Cybersecurity and Infrastructure Security Agency added a Sigma detection rule to its PHP2Shell alert on October 23. The agency’s alert stated that it had not observed successful exploitation. On the morning of October 26, CISA had not added either vulnerability to its Known Exploited Vulnerabilities catalog.