AhnLab flags spread of PHP2Shell attack code on GitHub

AhnLab's security threat analysis organization ASEC said attack code for the PHP2Shell PHP vulnerabilities is spreading quickly on GitHub and warned that running unverified code can expose users to further threats, according to bloter.net.

ASEC reported that 99 of the top 100 GitHub repositories, excluding forks, returned by searching "PHP2Shell" dealt with the related vulnerability. Of the repositories analyzed, 46 were classified as defense-oriented and 36 as proof-of-concept or practice-environment repositories.

Of 1,394 total stars on the analyzed repositories, 1,158 (83%) went to proof-of-concept repositories, while defense repositories received 148 stars. ASEC said 21 of the 27 proof-of-concept repositories it examined had fewer than 10 stars.

PHP2Shell is the collective name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow an attacker to execute malicious commands on a server without separate authentication.

AhnLab said its analysis was based on repository names, descriptions and topics rather than direct verification of the code. It recommended updating PHP to patched versions 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and checking servers already exposed externally for signs of compromise such as abnormal requests or suspicious files.

Earlier exploitation report

On 21 October 2026, overseas security firm WatchTower said it had observed exploitation of the vulnerability on its own attack-detection server network. Gnuboard, a PHP-based website building tool widely used in Korea, is among the software associated with the ecosystem.