PHP2Shell Exploitation Reaches Working Shells on Honeypots
Summary
Researcher Adel Karimi reported 35 shell launches on three honeypots on October 24, consistent with exploitation of CVE-2026-109618. The evidence came from a single-worker mod_php setup and does not establish reliability on other configurations.
Key points
- Karimi's honeypots recorded 35 shell launches on October 24: three on one honeypot and 32 across the other two.
- The activity used four stages of HTTP requests involving memory exhaustion, memory disclosure and a final shell command.
- The traffic closely matched a public proof of concept and was described as consistent with CVE-2026-109618.
- The honeypots used PHP 8.4.26 with Apache mod_php and a single worker; Karimi cautioned that the results do not establish reliability on other configurations.
- No second-stage payload download was observed.
- PHP patched CVE-2026-109618 and CVE-2026-109619 on October 21. CISA added a Sigma detection rule to its alert on October 23 but had not reported successful exploitation or listed the flaws in its KEV catalog as of October 26.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Memory disclosure
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-109618Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution.CVE-2026-109619Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for unauthenticated remote code execution.
People
Adel KarimiPerplexity researcher whose honeypots recorded shell execution; he reported the activity as consistent with exploitation of CVE-2026-109618 and cautioned that the results reflected a specific single-worker mod_php setup.Marcus HutchinsExpel principal threat researcher who characterized Karimi’s findings as a high-quality confirmation of in-the-wild PHP2Shell exploitation.