New PHP2Shell Exploit Gets Around a Key Defence, Raising the Stakes for PHP Servers

Security firm VulnCheck says it has developed what it believes is the first known exploit to achieve remote code execution against PHP2Shell on x86-64 systems that have ASLR enabled and use PHP's recommended production configuration. ASLR is a built-in defence that randomly arranges where a program's key data sits in memory, making it hard for attackers to run malicious code. VulnCheck has shared the exploit only with its Initial Access Intelligence customers.

The exploit targets CVE-2026-109618, a critical memory corruption bug in PHP that can lead to remote code execution. It is one of two flaws, alongside CVE-2026-109619, that make up PHP2Shell. The PHP Foundation disclosed both and released patches on Wednesday. According to The Register, there were reports on Thursday of attackers abusing the flaws days before disclosure, and of UK government websites proactively going offline.

VulnCheck's Spencer McIntyre said hundreds of proof-of-concept repositories have appeared on GitHub, but very few contain working exploits, largely because of ASLR. He called the new work a significant advance and does not expect that barrier to hold. VulnCheck also warned that threat actors appear to be using AI to look for more ways to attack, with McIntyre noting that adversaries are clearly spending time (and tokens) on this bug.