Researchers from VulnCheck have reported the first exploit for the PHP2Shell vulnerability (CVE-2026-109618b), which bypasses the Address Space Layout Randomization (ASLR) mechanism on x86-64 systems with standard PHP configurations. The exploit allows attacks on systems running PHP 8.4.10-8.4.26 in default configurations. Previously, the difficulty of determining the memory layout in the mod_php module hindered the implementation of an exploit that could achieve code execution on real systems. To bypass ASLR, the exploit utilizes an information leak regarding addresses in the error reporting code.
It has been stated that access to a working exploit is provided only to clients involved in information security, but malicious actors could reconstruct the technique used with the help of AI. To bypass the blocking of address layout information leakage, the setting in php.ini should be changed to "display_errors=off", in addition to previously published recommendations. VulnCheck also notes that hundreds of exploit prototypes have appeared on GitHub, but only a few have been assessed as functional and only one prototype has managed to bypass ASLR.
Additionally, the director of Cloudflare reported that the company is recording millions of attempts to exploit the PHP2Shell vulnerability, noting that just 10 hours prior to the announcement of the vulnerabilities, there were already thousands of such attempts, and two hours after the official disclosure, the number reached hundreds of thousands. Apparently, the attacks are using exploit prototypes that only detect the presence of vulnerable PHP versions, as there is currently no information about confirmed cases of hacking through PHP2Shell vulnerabilities.
According to Amazon, the first attempts at exploitation were recorded by deployed honeypot systems as early as October 17, i.e., 3 days before the first information leak regarding CVE identifiers. Activity intensified on October 21, 12 hours before the release of the PHP corrective updates, during which attempts utilizing several exploit prototype variants were recorded. Attack attempts before the official disclosure were also noted by the Hadrian company.
Source: opennet.ru
