Researchers from the company VulnCheck announced they have obtained the first exploit for the PHP2Shell vulnerability (CVE-2026-109618b), bypassing the address randomization mechanism (ASLR) on x86-64 systems with a typical PHP configuration. The exploit allows you to attack systems with PHP 8.4.10-8.4.26 in the default configuration. Previously, the difficulty of determining the memory layout in the mod_php module prevented the implementation of an exploit that allowed the code to execute on real systems. To bypass ASLR, the exploit involves leaking address information in the error display code.
It is stated that access to the working exploit is limited to clients involved in information security, but attackers can recreate the technique used using AI. To work around blocking leakage of address layout information, you should set the “display_errors=off” parameter in php.ini, in addition to previously published recommendations. VulnCheck also mentions that hundreds of exploit prototypes have appeared on GitHub, but only a few have been evaluated as working and only one prototype was able to bypass ASLR.
In addition, the director of Cloudflare reported that the company records millions of attempts to exploit PHP2Shell vulnerabilities, despite the fact that 10 hours before the announcement of the vulnerabilities there were already thousands of such attempts, and 2 hours after the official disclosure of information reached hundreds of thousands. Apparently, the attacks use prototype exploits that only detect the presence of vulnerable versions of PHP, since there is no information yet about confirmed cases of hacking through PHP2Shell vulnerabilities.
By Datafrom Amazon, the first exploitation attempts were recorded by deployed honeypot systems as early as October 17, i.e. 3 for before the leak of the first information about CVE identifiers. Activity intensified on October 21, 12 hours before the publication of corrective PHP updates, at which time attack attempts were recorded using several variants of exploit prototypes. Attempted attacks before the official disclosure of information were also recorded by Hadrian.