Developments in PHP2Shell Attacks
Just two days after the release of emergency updates to address PHP2Shell vulnerabilities (tracked as CVE-2026-109618 and CVE-2026-109619), cybersecurity firms detected intensive attempts by threat actors to exploit these vulnerabilities to deploy a variant of the well-known Mirai botnet. Despite the severity of the vulnerabilities, which allow for remote code execution (RCE) and received a CVSS v4.0 rating of 9.2, no successful breaches in real-world environments have been confirmed yet.
Technical Challenges Facing Attackers
Analyses from firms such as Sophos and Hunt.io indicate that attackers are facing extreme difficulties in turning these vulnerabilities into effective exploits. Sansec explained that the vulnerabilities require precise knowledge of server configurations and specific operating conditions, as most publicly available tools fail when confronted with default PHP settings.
Meanwhile, VulnCheck successfully developed an exploit that bypasses ASLR (Address Space Layout Randomization) technology in x86-64 systems, a memory protection technique that was previously considered a major obstacle for attackers. However, this exploit remains available only to the company's clients, reflecting the gap between publicly available tools and advanced offensive capabilities.
What is Changing Practically?
- Exploit Complexity: Tools found on attacker servers (via SOCRadar) showed that attackers are conducting intensive lab experiments, but failing to compromise real servers that do not match their test environments.
- Precautionary Measures: Concerns over these vulnerabilities led many organizations, including government and educational entities in Europe, to temporarily shut down their systems as a preventative measure while applying updates.
- Patching Gap: Qualys data revealed a major challenge in patch management, as millions of PHP copies are still running very old versions (End-of-Life) that will not receive any security patches, making them vulnerable to long-term risks.
Security Context
The vulnerabilities were discovered last August by Wiz, OpenAI, and Calif, and the release of updates (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35) was expedited on October 21 following the leakage of CVE identifiers. Although initial exploitation attempts were detected by Amazon on October 17, the attack activity has not translated into confirmed breaches at this moment, giving system administrators a crucial window of opportunity to apply updates before attackers develop more efficient tools.