Researchers Report PHP2Shell Exploits in Honeypots and a CTF Server
Summary
A researcher reported 35 successful PHP2Shell exploits across six honeypots, and a CTF server running PHP 8.4.26 was exploited. The article urges patching CVE-2026-109618 and CVE-2026-109619 and describes a separate PHP RCE flaw.
Key points
- Perplexity researcher Adel Ka said six honeypots recorded 35 successful PHP2Shell exploits from two IP addresses.
- A CTF server running PHP 8.4.26 was exploited less than four hours after its page was made accessible; Jaydip Modhwadia won the bitcoin challenge.
- The published proof of concept uses memory and address leaks, bypasses ASLR, and manipulates PHP structures to reach command execution.
- The PHP Foundation and government cybersecurity agencies urged organizations to update to patched versions or take exposed PHP systems offline.
- Some security firms reported working exploits and later retracted those claims; other researchers reported successful proof-of-concept exploits.
- PHP reserved CVE-2026-115560 for a separate RCE flaw and recommended setting session.upload_progress.enabled=0 until a regular fix is released.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical for CVE-2026-115560; severity not stated for PHP2Shell
- Affected Versions
- PHP 8.4.26
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Set session.upload_progress.enabled=0 until the next regular bug-fix release; PHP says this mitigates CVE-2026-115560 and also recommended it for CVE-2026-109619.
- Update PHP-using systems to a patched version or take them offline, especially if they are internet-connected.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe published exploit for the CTF demonstration used PHP's zif_system handler to execute a command and return a proof marker.T1190 · Exploit Public-Facing ApplicationPHP2Shell exploits were recorded against honeypots and demonstrated against an internet-accessible PHP CTF server.
CVE
CVE-2026-109618following the PHP Foundation's hasty publication of patches after details of the flaws - tracked as CVE-2026-109618 and CVE-2026-109619 - leaked prematurely (see: Waiting for the PHP2Shell Onslaught as PoCsCVE-2026-109619hasty publication of patches after details of the flaws - tracked as CVE-2026-109618 and CVE-2026-109619 - leaked prematurely (see: Waiting for the PHP2Shell Onslaught as PoCs Proliferate).CVE-2026-115560As a result, the PHP team doesn't plan to issue an emergency fix for the vulnerability, for which it's reserved CVE-2026-115560. Instead, the bug will get patched in the next release.
People
Adel KaPerplexity detection and response lead who reported that six honeypots recorded 35 successful in-the-wild PHP2Shell exploits.Alon GalHudson Rock CTO who described technical details of the demonstrated exploit, including address leaks, ASLR bypass, and command execution.Daniel CardBritish cybersecurity researcher who commented on the need for accurate vulnerability intelligence and urged PHP users to patch.Ian Thornton-TrumpInversion6 CISO who commented on the difficulty of developing working exploits after the patches were released.James PavurSecurity researcher who created the Steal My Bitcoin CTF challenge to test whether a working PHP2Shell exploit would be developed.Jaydip ModhwadiaPenetration and vulnerability tester who successfully exploited PHP2Shell in the CTF and published a Python proof-of-concept; the article says he goes by “KillaBoi” on GitHub.Marcus HutchinsMalware analyst tracking PHP2Shell proof-of-concept exploits; he described the honeypot report as a high-quality confirmation of in-the-wild exploitation.Matthew HickeySecurity researcher who said the CTF exploitation demonstrated that PHP2Shell could be exploited in the wild.
Products
Apachethe highest quality confirmation of in-the-wild php2shell exploitation I've seen so far," and involved an Apache server running PHP 8.4.26.NGINXASLR and manipulating PHP's internal structures to achieve command execution, all while working around Nginx's 1MB request limit," said Alon Gal, CTO of threat intelligence firm Hudson Rock.PHPSecurity researchers for days have seen millions of exploit attempts, especially in the days following the PHP Foundation's hasty publication of patches after details of the flaws - tracked as CVE-2026-109618 and