PHP2Shell exploits run shell commands on honeypots
PHP2Shell exploitation has apparently succeeded in running shell commands on internet-facing honeypots, which are decoy systems used to observe attacks. A Perplexity researcher recorded commands using wget, curl and the PHP command-line interface to contact 162.35.99[.]94 over ports 80 and 8080. The requests identified the targeted honeypot and, in some cases, the account running the command. No downloaded second-stage files have been observed, so the purpose and capabilities of any follow-on payload remain unknown.
The activity concerns CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can produce remote code execution, meaning an attacker can run commands on the affected host from elsewhere. Both can affect default PHP configurations. Cloudflare reported millions of exploitation attempts following public disclosure, while Defused Cyber observed probes against Palo Alto Networks GlobalProtect honeypots from 204.76.203[.]7, an address associated with mass exploitation. Those requests included the PHP session upload-progress marker p2s-rider and a dummy upload without a payload, behavior assessed as vulnerability checking and target-list building.
Datadog described the exploitation process as dependent on carefully exhausting available memory at a particular stage and finding usable memory locations despite address space layout randomization (ASLR), a protection that changes where data is placed in memory. PHP creates several copies of a form-field name while processing a request. An attacker can use an unusually sized name to trigger an allocation failure while PHP is copying it into a hash table. The request must be small enough to be accepted but structured so that the copy exceeds PHP's configured memory limit.
ReliaQuest reproduced CVE-2026-109618 in a controlled laboratory and published detection guidance on October 22, 2026. Its test produced a sequence across PHP, Apache and system logs: a POST request received an HTTP 500 error, PHP recorded memory exhaustion and heap corruption, and the Apache worker processing the request crashed. Hosting teams can use that combination as a potential warning sign rather than treating any single server error as proof of exploitation.
Palo Alto Networks Unit 42 has meanwhile withdrawn an earlier conclusion that an attack on a European government agency began through the PHP2Shell vulnerabilities. Unit 42 said the attack occurred in the context of a vulnerable PHP application, but it could not confirm that either specific CVE provided initial access. That correction is important because the post-compromise behavior remains notable, but it cannot be presented as a confirmed PHP2Shell intrusion.
In that incident, Unit 42 observed access to password hashes and multi-factor authentication secrets within two hours, along with an NT LAN Manager (NTLM) relay tunnel into Active Directory, the Microsoft system used to manage organizational identities and permissions. The attacker also attempted to gain Domain Admin privileges. Commands examined authentication data, queried the domain controller through anonymous Lightweight Directory Access Protocol (LDAP) requests, and searched for internal hosts, privileged groups, interactive users and links between DNS and Active Directory. Output sections used consistent delimiters such as ==SHELLUSER== and ==PASSWD==, which Unit 42 assessed as machine-readable formatting for an agentic AI system able to plan and execute batches of tasks.
Separately, CYFIRMA reported low-volume PHP2Shell scanning from 21 compromised nodes against 216 unpatched or partially mitigated hosts. The identified systems were in the U.S., Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the U.A.E., Saudi Arabia and the E.U. They covered government, finance, logistics, aviation, manufacturing and online transaction services. CYFIRMA said nodes were rotated or abandoned when blocking or rate limits appeared, reducing the chance that simple volume thresholds would detect the campaign.
CYFIRMA attributed that scanning with moderate confidence to a Korean-speaking operator associated with the Lazarus Group ecosystem. The assessment drew on activity in a closed I2P anonymity network, infrastructure previously linked to exploitation of web assets, language characteristics, and the group's history of compromising PHP and WordPress servers to install web shells or use them for command-and-control traffic. CYFIRMA said operators were discussing target prioritization and adapting public exploits, but its account described scanning and preparation rather than confirmed exploitation of the 216 listed hosts.
A third issue, CVE-2026-115560, has also been disclosed by the PHP Foundation. Remote code execution requires an unusual combination of application behavior and configuration: session.serialize_handler must initially use php_binary or php_serialize, the application must change it to php through ini_set() before calling session_start(), and session upload progress must remain enabled. Applications that do not change the serialization handler while running can leave upload progress enabled. The PHP Foundation expects the issue to be addressed through the regular release cycle.
Xint has released a scanner for PHP2Shell exposure and says remote code execution can affect any PHP script, regardless of the application, as well as applications that perform decoding through functions such as session_start() and unserialize(). Bitsight's internet-wide measurements found nearly 37 million public-facing systems running PHP or related software, with the largest concentrations in the U.S., Germany, France, the Netherlands and Japan. Because these flaws are in the PHP runtime itself, changing application code, installing a plugin update or relying on a web application firewall does not remove the underlying weakness. PHP must be updated on the host.
Website owners should therefore verify the PHP runtime used by every site and application, not only update WordPress or its extensions. For owners who want management handled for them, AEU Hosting provides managed WordPress hosting, secured end to end. Whether PHP is self-managed or supplied by a hosting provider, the immediate priorities are updating it and reviewing logs for the error sequence and probing patterns documented by the researchers.