CVE-2026-109618
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
Vulnerabilities & Exploits · Zero-Day Exploit
Perplexity researcher Adel Karimi recorded 35 PHP2Shell shell executions across three honeypots on October 24, confirming attackers could run commands on the monitored PHP servers. The request chain was consistent with CVE-2026-109618; the evidence does not show that attackers used both PHP2Shell flaws.
The four-stage HTTP chain first exhausted PHP memory, then exposed contents left in memory. That information helped the exploit get past address space layout randomization (ASLR), which makes memory locations harder to predict, and execute a shell command. Here, the crash is part of the route to command execution, not simply a failed attempt.
Karimi’s honeypots used a single-worker Apache mod_php setup that favored the exploit, so the 35 shells do not establish reliability across other PHP builds or configurations. For teams with internet-facing PHP services, the finding confirms a foothold is possible, but does not show whether other deployments are similarly exposed or whether any pre-patch host was compromised; no follow-on payload was observed.
3 sources · 1h ago
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
SecurityWeek
PHP2Shell Exploitation Moves From Probes to Working Shells
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.
originalBleepingComputer
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
originalSANS ISC
(Reliable)? php2shell exploitability - SANS ISC
php2shell exploitability, Author: Bojan Zdrnja
originalPart of the PlainSec briefing for 2026-10-26
Every edition of this story: PHP2Shell reaches confirmed shell execution on honeypots