Researchers Find Lab-Tested PHP2Shell Exploit Tooling on Exposed Server
Summary
SOCRadar researchers found lab-tested PHP2Shell RCE tooling and website-screening scripts on an exposed operator server. About 20 sites were checked; 11 probes found no exploit preconditions or evidence of shell access.
Key points
- An exposed directory listing on an operator-controlled server revealed a lab-tested PHP2Shell RCE chain for PHP 8.4.26 running as Apache mod_php.
- The chain recycles a PHP worker, leaks memory addresses through a session cookie to bypass ASLR, then abuses session upload progress to run a short shell command.
- Companion scripts screened about 20 public websites and probed 11 for PHP settings and other exploit preconditions; none met the conditions, and no shell access was observed.
- Six probed sites reported PHP 8.4 releases older than the fix, but none displayed errors, exposed phpinfo settings, revealed file-inclusion flaws, or echoed the test session.
- SOCRadar assesses with moderate confidence that the tooling targets CVE-2026-109618. The operator is unattributed; other server files point to separate activity involving cryptocurrency and Web3 targets.
- Researchers recommend updating PHP, disabling display_errors and session upload progress, enabling session strict mode, removing public phpinfo pages, and hunting for the described probe traffic.
Article Details
- Attack Vectors
- A lab-tested PHP2Shell remote-code-execution chain targeted PHP 8.4.26 running as Apache mod_php. It recycled a PHP worker, used session-cookie memory leaks to bypass ASLR, and abused session upload-progress handling to run a shell command.
- The exploit required displayed PHP errors, session upload progress enabled, session strict mode disabled, a very low memory limit, and a single Apache worker.
- Companion scripts screened public websites by reading PHP and server headers, probing PHP settings and common phpinfo paths, testing file-inclusion parameters, and checking session injection behavior.
- A separate WordPress script enumerated users, checked plugins and XML-RPC methods, tested pingback, and looked for exposed debug logs.
- The article reports no successful exploitation or shell access on the screened sites; none met the exploit’s preconditions.
- Defensive Notes
- Update PHP to a fixed release: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Block 206.188.197[.]105 and search web and proxy logs for prior connections.
- Look for unfamiliar multipart POST requests containing PHP_SESSION_UPLOAD_PROGRESS, especially uploads named MARKER_ followed by eight hexadecimal characters.
- Keep display_errors off, set session.use_strict_mode=1, disable session.upload_progress.enabled, and remove public phpinfo pages.
- Set expose_php=Off to prevent the X-Powered-By header from revealing the PHP version.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 206[.]188[.]197[.]105 | Attacker staging and operations server; its exposed directory listing held the operator’s tools. |
MITRE ATT&CK
T1090 · ProxyScreening traffic was routed through a rotating proxy pool hosted on the same server.T1190 · Exploit Public-Facing ApplicationThe operator built an exploit for internet-facing mod_php servers; the article reports no successful use on screened sites.T1587.004 · ExploitsThe operator built and lab-tested a PHP2Shell remote-code-execution chain.T1592.002 · SoftwareA screening script read PHP and server versions from response headers.T1595.002 · Vulnerability ScanningScripts probed websites for upload-progress behavior, displayed errors, phpinfo pages, and file-inclusion conditions.
CVE
Products
ApacheWorking exploit chain: An exposed attacker server held a lab-tested PHP2Shell exploit for PHP 8.4.26 running as Apache mod_php, the last vulnerable 8.4 release.PHPWorking exploit chain: An exposed attacker server held a lab-tested PHP2Shell exploit for PHP 8.4.26 running as Apache mod_php, the last vulnerable 8.4 release.WordPressWordPress Follow-Up Reconnaissance
Tools
aslr_exploit.pyThe central file, aslr_exploit.py, is a Python exploit the operator labels a “one-click” PHP2Shell exploit for PHP 8.4.26 under Apache mod_php.deep_probe.pyThe second script, deep_probe.py, examines 11 of those sites more closely.php2shellSOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an open, unauthenticated directory listing.php2shell_fp.pyThe first script, php2shell_fp.py, works through a list of about 20 websites.wp_attack.pyA third script, wp_attack.py, turns to five of the WordPress sites.
Countries
CanadaThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.ChinaThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.FinlandThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.FranceThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.PolandThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.United KingdomThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.United StatesThe screening reached public websites across Europe, North America, and Asia, including the United Kingdom, Finland, Poland, France, Canada, the United States, and China.