Attackers ran shell commands on Adel Karimi’s PHP2Shell honeypots on Oct. 24, according to SecurityWeek’s account of his research. The Perplexity researcher’s sensors recorded 35 shells launched across three honeypots. One IP address produced three shells on one honeypot; another produced 32 across all three.
That marked a change from Karimi’s first report, which covered just over 26 hours and logged 30 out-of-memory errors and 11 worker crashes, but no code execution. SecurityWeek reports that the honeypots ran PHP 8.4.26 under Apache mod_php with a single worker.
PHP patched the two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Oct. 21, SecurityWeek reports. Its account describes a four-stage chain of HTTP requests: some exhausted PHP memory, others leaked memory contents, and the last executed a shell command. SecurityWeek says the traffic closely matched a public proof of concept and was consistent with exploitation of CVE-2026-109618, according to Karimi.
“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Karimi said, as quoted by BleepingComputer. Expel threat researcher Marcus Hutchins called the findings “by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I’ve seen so far.”
Karimi cautioned that the evidence came from an “intentionally favorable single-worker mod_php profile” and did not measure reliability on other worker counts, PHP builds or applications, SecurityWeek reports. The outlet also reports that no second-stage payload download was observed.
Comments