PHP2Shell attacks executed shell commands on three honeypot servers on October 24, Perplexity researcher Adel Karimi reported. His sensors recorded 35 shell launches, providing evidence that attacks had progressed beyond the crashes and memory errors seen during his earlier monitoring.
The finding has a specific scope: Karimi’s decoy servers ran PHP 8.4.26 with Apache mod_php and a single worker process. He described that configuration as intentionally favorable to exploitation and cautioned that the results do not establish reliability on other PHP builds, applications or worker counts.
The two critical vulnerabilities known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, permit remote code execution without authentication. According to SecurityWeek, PHP issued patches on October 21 after information about the flaws leaked online. Exploitation attempts preceded the fixes, and millions have since been recorded. Before Karimi’s findings, security firms had not confirmed that those attempts had successfully executed code, although researchers had developed exploits that bypassed ASLR protections.
What the honeypots captured
Karimi’s servers displayed ordinary pages backed by PHP. During his first observation period, lasting just over 26 hours, he counted 30 out-of-memory errors and 11 worker crashes without detecting code execution.
The October 24 activity produced a different result. Traffic from one IP address launched three shells on one server; a second address accounted for 32 shell launches distributed across all three honeypots.
Karimi traced the activity through four stages of HTTP requests, involving memory exhaustion, disclosure of memory contents and, finally, execution of a shell command. He said the request pattern closely resembled a publicly available proof-of-concept exploit and was consistent with CVE-2026-109618. The observation therefore does not establish successful exploitation of both PHP2Shell vulnerabilities.
Karimi characterized the evidence as confirmed remote code execution with usable memory disclosure. No download of a second-stage payload was observed. Marcus Hutchins, Expel’s principal threat researcher, called it the strongest confirmation of in-the-wild PHP2Shell exploitation he had seen so far.
Broader exposure and patch guidance
The demonstrated configuration is narrower than the affected scope described in CISA’s alert. The agency says the vulnerabilities affect all PHP installations handling web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. It identifies Apache with mod_php as the configuration PHP considers highest risk.
CISA lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the fixed releases for their respective branches. It urges immediate patching, with internet-facing systems taking priority, and an inventory that accounts for PHP bundled inside other software.
For organizations unable to update immediately, including those running unsupported PHP 8.1 or earlier versions, CISA recommends taking PHP-based systems offline until they can be patched or updated. A web application firewall may offer some interim protection, the agency says. Its monitoring guidance includes watching for PHP worker processes that start shells or download tools.
CISA’s October 23 alert update added a Sigma detection rule and stated that the agency had not observed successful exploitation at that time, before Karimi’s October 24 observations. SecurityWeek reported that, as of the morning of October 26, neither vulnerability had been added to CISA’s Known Exploited Vulnerabilities catalog.
