PHP2Shell Exploitation Moves From Probes to Working Shells
Attackers successfully exploited PHP2Shell vulnerabilities, launching 35 shells from two IP addresses.
Run PHP?
Get an email when a reviewed story names PHP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Researchers have confirmed successful exploitation of the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against honeypot servers. Attackers launched 35 shells from two IP addresses, demonstrating actual remote code execution beyond mere probes. While PHP released patches on October 21, exploitation attempts, including those bypassing ASLR, were observed prior to the fixes.
The lesson from this incident
Full lessonAttackers successfully exploited two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to launch 35 remote shells against honeypot servers, confirming real-world weaponization beyond scanning activity. Exploitation was observed prior to the release of official patches on October 21, meaning organizations had a narrow window of exposure that many likely missed. The fact that ASLR bypass techniques were employed demonstrates that attackers were using sophisticated methods, not just opportunistic scanning. This incident underscores how quickly critical vulnerabilities move from proof-of-concept to active exploitation, leaving organizations that lack rapid patch deployment processes severely exposed.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-109618
- cve — CVE-2026-109619