// AI threat desk · 27 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighRCECVSS not assigned

Attackers ran shell commands on honeypots via PHP2Shell flaws

Adel Karimi recorded 35 shells across three honeypots on Oct 24, after Recorded Future said PHP released fixes on Oct 21.

· 2 min read
AI-generated image of analysts monitoring honeypot servers and blurred command-line screens in a security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Adel Karimi recorded 35 shells launched across three honeypots on Oct 24.
  • Recorded Future said PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct 21.
  • SecurityWeek reported that exploitation attempts began before fixes were released and that millions had been recorded since.

SecurityWeek reported that exploitation attempts began before the fixes were released, while security firms had not confirmed successful code execution at that point.

On this page

The attack chain used four stages before execution

The observed requests used a four-stage multipart chain, sometimes with retries: memory pressure, memory disclosure through an oversized PHPSESSID, further memory pressure and a target-adjusted execution stage.

The honeypot evidence correlated 35 execution-stage HTTP POSTs with 35 shells directly parented by Apache workers across three PHP targets.

PHP2Shell affects PHP across common website deployments

SecurityWeek said the PHP2Shell flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and allow unauthenticated remote code execution.

Researchers linked the flaws to PHP2Shell activity

Recorded Future said Wiz Research found the flaws with Calif and OpenAI and reported them to PHP in August. The PHP2Shell name comes from that research.

Amazon Threat Intelligence publicly confirmed that it observed a PHP2Shell exploitation attempt in its MadPot honeypot system on Oct 17, Infosecurity Magazine reported.

Palo Alto Networks Unit 42 said it is unable to confirm that initial access is associated with the specific PHP2Shell CVEs, and updated its brief on Oct 25 to retract its Oct 23 update.

CISA said it had not observed successful exploitation in the wild as of its Oct 23 publication. Adel Karimi later recorded the shell launches on Oct 24.

What to do now

  1. Immediately update PHP to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

FAQ

What happened in the PHP2Shell attacks?

Adel Karimi recorded 35 shells launched across three honeypots on Oct 24. The honeypot evidence correlated 35 execution-stage HTTP POSTs with 35 shells directly parented by Apache workers.

Which PHP versions are affected by PHP2Shell?

Recorded Future said PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct 21.

What are the PHP2Shell CVE numbers?

SecurityWeek said the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

Has PHP2Shell been exploited?

Adel Karimi recorded shells on three honeypots on Oct 24. CISA said it had not observed successful exploitation in the wild as of its Oct 23 publication.

How do I fix PHP2Shell?

CISA listed PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as update targets.

How does the PHP2Shell attack chain work?

The observed requests used memory pressure, memory disclosure through an oversized PHPSESSID, further memory pressure and a target-adjusted execution stage.

Sources

  1. Critical Vulnerabilities in PHP Require Immediate Patching | CISA, CISAPrimary
  2. honeypot-data/reports/php2shell/2026-10-24-confirmed-rce.md at main · 0x4D31/honeypot-data, GitHubPrimary
  3. Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25), Palo Alto Networks Unit 42Primary
  4. PHP2Shell Exploitation Moves From Probes to Working Shells, SecurityWeek
  5. PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity, The Hacker News
  6. PHP2Shell Exploitation: Two Critical PHP Flaws Explained, Recorded Future
  7. PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure, Infosecurity Magazine
How we checked this story
ClaimSourceStatus
SecurityWeek reported that attackers successfully exploited PHP2Shell to run shell commands on honeypot servers.SecurityWeekAttributed
SecurityWeek said the PHP2Shell flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and allow unauthenticated remote code execution.SecurityWeekAttributed
SecurityWeek reported that exploitation attempts began before fixes were released and that millions had been recorded since.SecurityWeekAttributed
Adel Karimi recorded 35 shells launched across three honeypots on October 24.Adel Karimi, via SecurityWeekAttributed
The honeypot evidence correlated 35 execution-stage HTTP POSTs with 35 shells directly parented by Apache workers across three PHP targets.0x4D31, via GitHubConfirmed
The observed requests used a four-stage chain involving memory pressure, memory disclosure, further memory pressure and execution.0x4D31, via GitHubConfirmed
Recorded Future said PHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21.Recorded FutureAttributed
Recorded Future reported that Wiz discovered the flaws with Calif and OpenAI and reported them to PHP in August.Recorded FutureAttributed
CYFIRMA said the Hacker News reported that a suspected North Korea-linked campaign was probing global PHP infrastructure from 21 compromised nodes.CYFIRMA, via The Hacker NewsAttributed
CISA said it had not observed successful exploitation in the wild at the time of its publication.CISAConfirmed
Unit 42 said its researchers initially thought post-compromise activity against a European government agency involved PHP2Shell exploitation, then retracted that assessment.Palo Alto Networks Unit 42Confirmed
Unit 42 said it could not confirm that the European agency’s initial access involved the specific PHP2Shell CVEs.Palo Alto Networks Unit 42Confirmed
Unit 42 described CVE-2026-109618 as involving uninitialized request memory after out-of-memory errors, enabling attackers to achieve remote code execution.Palo Alto Networks Unit 42Confirmed
Cortex Xpanse identified more than 22.6 million potentially vulnerable exposed instances based on Palo Alto Networks telemetry.Palo Alto Networks Unit 42Confirmed
Palo Alto Networks said Advanced Threat Prevention Plus with Frontier Virtual Patching has protected customers against the vulnerabilities since October 20.Palo Alto NetworksConfirmed
Palo Alto Networks said Advanced Threat Prevention provides protections through signatures 543004, 97622, 97623, 97624 and 97625.Palo Alto NetworksConfirmed
Unit 42 updated its threat brief on October 25 to retract its October 23 update.Palo Alto Networks Unit 42Confirmed
CISA published its report on Oct 23, 2026.CISAConfirmed
unit42.paloaltonetworks.com published its report on Oct 23, 2026.unit42.paloaltonetworks.comConfirmed

Could not verify

  • Whether the 35 confirmed shells affected production systems is not established
  • Whether the reported exploitation attempts compromised real-world systems is not established
  • Whether the two confirmed source-address episodes were operated by the same actor is not established
  • How many internet-facing PHP systems were actually vulnerable or compromised is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok