PHP2Shell flaw exploited: 35 shell executions on honeypot servers
Researcher Adel Karimi of Perplexity recorded the attacks on October 24, 2026, against servers running PHP 8.4.26; PHP has issued fixed releases.
A security researcher at Perplexity, Adel Karimi, observed 35 shell executions on three honeypot servers exploiting the PHP2Shell vulnerability tracked as CVE-2026-109618, according to dailysecu.com. The attacks were recorded on October 24, 2026.
Two IP addresses carried out the activity: one accounted for 3 shell executions and the other for 32. The targeted systems ran PHP 8.4.26 under Apache mod_php.
The attack used multi-stage HTTP requests to exhaust PHP memory, leak internal memory information and then execute commands. The flow matched the published proof-of-concept code and the exploitation method of CVE-2026-109618.
No follow-up malicious activity, such as the download of additional malware, was observed after the shell executions.
Fixed releases available
The PHP development team has released fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and recommends immediate updating.
PHP2Shell is the collective name for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 critical under CVSS v4.0 and disclosed on October 21, 2026. Deutsche Telekom's security team observed requests similar to the exploit code shortly after the disclosure, and Amazon Threat Intelligence detected attack attempts from October 17, before the official disclosure.
Quick answers
What is PHP2Shell?
PHP2Shell is the collective name for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 critical under CVSS v4.0 and disclosed on October 21, 2026.
Which PHP versions fix the vulnerability?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP development team.
Was malware downloaded during the attacks?
No follow-up malicious activity such as downloading additional malware was observed.