PHP2Shell attackers reportedly run shell commands on Adel Karimi’s honeypots

PHP patched the two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Oct. 21, SecurityWeek reports. Its account describes a four-stage chain of HTTP requests: some exhausted PHP memory, others leaked memory contents, and the last executed a shell command. SecurityWeek says the traffic closely matched a public proof of concept and was consistent with exploitation of CVE-2026-109618, according to Karimi.

“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Karimi said, as quoted by BleepingComputer. Expel threat researcher Marcus Hutchins called the findings “by far the highest quality confirmation of in-the-wild PHP2Shell exploitation I’ve seen so far.”

Karimi cautioned that the evidence came from an “intentionally favorable single-worker mod_php profile” and did not measure reliability on other worker counts, PHP builds or applications, SecurityWeek reports. The outlet also reports that no second-stage payload download was observed.