Morphisec Reports PHP2Shell Exploitation Targeting Windows IIS Servers

Summary

Morphisec says it observed PHP2Shell post-exploitation activity on a customer’s Windows IIS/PHP-CGI server and blocked the payload with AMTD. The company says AMTD disrupted in-memory shellcode but does not patch the vulnerable PHP runtime.

Key points

Morphisec reports that a customer’s Windows server running IIS and PHP-CGI was targeted following exploitation of PHP2Shell; the company says its agent blocked the post-exploitation payload.
The reported process chain ran from the IIS worker to PHP-CGI, a command shell and a packed binary that attempted a reverse shell.
Morphisec says the payload used PEB-based shellcode to resolve networking libraries and that AMTD’s altered memory layout caused the shellcode to fail.
The company says AMTD did not prevent exploitation of the PHP vulnerability; it disrupted activity after code execution and does not replace patching.
The article cites a Qualys survey finding that 110 million of 167 million PHP package installations in its customer base used end-of-life branches, and an OX Security report that 93.6% of 2.2 million internet-facing PHP instances seen on Shodan remained vulnerable five days after disclosure.
Sophos recommends reviewing exposed PHP server activity from August 1, 2026, including unexpected command-shell processes, outbound connections, web-accessible files, and PHP worker crashes or restarts.

Article Details

Event Type: Morphisec reports confirmed PHP2Shell post-exploitation activity targeting Windows servers running IIS with PHP-CGI, and says its AMTD technology blocked a payload on a customer server.
Impact: The reported attack chain reached command execution and attempted to launch a packed binary and establish a reverse shell to an external command-and-control server; Morphisec says AMTD blocked the post-exploitation payload. The article reports that Qualys found 110 million of 167 million surveyed PHP package installations were on end-of-life branches, and that OX Security found 93.6% of 2.2 million internet-facing PHP instances visible on Shodan were still vulnerable. These figures are attributed estimates and observations, not a count of confirmed compromises.