{"id":183970,"date":"2026-10-23T11:41:04","date_gmt":"2026-10-23T09:41:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/dlya-uyazvimostej-php2shell-anonsirovan-pervyj-eksploit-obhodyashhij-randomizacziyu-adresov"},"modified":"2026-10-23T11:41:09","modified_gmt":"2026-10-23T09:41:09","slug":"first-exploit-bypassing-address-randomization-announced-for-php2shell-vulnerabilities","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/first-exploit-bypassing-address-randomization-announced-for-php2shell-vulnerabilities","title":{"rendered":"The first exploit bypassing address randomization has been announced for the PHP2Shell vulnerabilities.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from VulnCheck have reported the first exploit for the PHP2Shell vulnerability (CVE-2026-109618b), which bypasses the Address Space Layout Randomization (ASLR) mechanism on x86-64 systems with standard PHP configurations. The exploit allows attacks on systems running PHP 8.4.10-8.4.26 in default configurations. Previously, the difficulty of determining the memory layout in the mod_php module hindered the implementation of an exploit that could achieve code execution on real systems. To bypass ASLR, the exploit utilizes an information leak regarding addresses in the error reporting code. <\/p>\n
It is claimed that access to the working exploit is provided only to clients involved in information security, but attackers can recreate the techniques used with AI. To bypass the information leak blocking regarding address layouts, the parameter 'display_errors=off' should be set in php.ini, in addition to previously published recommendations. VulnCheck also mentions that hundreds of exploit prototypes have appeared on GitHub, but only a few have been evaluated as functional, and only one prototype was able to bypass ASLR.<\/p>\n
Additionally, the director of Cloudflare reported that the company is recording millions of attempts to exploit the PHP2Shell vulnerability, noting that just 10 hours prior to the announcement of the vulnerabilities, there were already thousands of such attempts, and two hours after the official disclosure, the number reached hundreds of thousands. Apparently, the attacks are using exploit prototypes that only detect the presence of vulnerable PHP versions, as there is currently no information about confirmed cases of hacking through PHP2Shell vulnerabilities.<\/p>\n
According to Amazon, the first attempts at exploitation were recorded by deployed honeypot systems as early as October 17, i.e., 3 days before the first information leak regarding CVE identifiers. Activity intensified on October 21, 12 hours before the release of the PHP corrective updates, during which attempts utilizing several exploit prototype variants were recorded. Attack attempts before the official disclosure were also noted by the Hadrian company. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"