Attackers used the PHP2Shell flaws to run commands on decoy servers a security researcher had set up to watch for them, BleepingComputer reported Monday. It is the first detailed public evidence that the two critical bugs in PHP, the programming language behind much of the web, can be exploited outside a lab, which turns patching unpatched internet-facing PHP servers from a precaution into an urgent task. No real organization has been confirmed as a victim.
What Happened
Adel Karimi, detection and response lead at Perplexity, recorded the attacks on honeypots, which are servers exposed on purpose to attract and record attackers. In a report on GitHub that BleepingComputer cites, three disposable machines ran PHP 8.4.26 inside the Apache web server through its mod_php module, each with a single worker process. On Oct. 24 (UTC), they logged 35 shells, or command sessions an intruder can use to run programs, launched by the web server: three from one source address beginning at 15:35 UTC and 32 from a second later that day.
The report counted a shell only when process monitoring and network captures lined up; crashes and error responses alone did not count. The attack came in four steps. Two strained the server's memory, and one returned an oversized session cookie of about 800 KB that leaked memory contents, letting the attacker get around address space layout randomization, a defense that scatters a program's code in memory. The final step ran the command. The intruders checked which user and machine they had reached and tried to contact their own servers, but no follow-on malware download was seen.
The chain closely matches a public proof-of-concept exploit and is consistent with CVE-2026-109618; the report says the records do not show the companion flaw, CVE-2026-109619, being used. It also sets limits: the single-worker setup was deliberately favorable, so the results say nothing about reliability on other configurations, and shared tooling across the two addresses, both on U.S. hosting networks, does not prove a single actor.
Marcus Hutchins, a researcher at Expel who had been checking claimed successes, called it the highest-quality confirmation of in-the-wild exploitation he had seen, according to BleepingComputer. Until then, the outlet noted, Dataminr had described activity as scanning, fingerprinting and exploits that did not work.
Unit 42 Withdraws Its Break-in Account
At 2:15 p.m. PT Oct. 25, Palo Alto Networks' Unit 42 research team retracted an Oct. 23 update to its threat brief that had tied an intrusion at a European government agency to PHP2Shell. The brief now says Unit 42 is "unable to confirm that initial access is associated with the specific PHP2Shell CVEs." The Primary Wire's Oct. 25 story relied on that update and has been corrected.
Palo Alto's product advisory, revised Monday, lists four more hotfixes for its PAN-OS firewall software as released, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36 and 11.1.13-h16, for seven in total. The remaining 13 carry estimates from Oct. 27 to Oct. 30. The flaw affects only the firewalls' management web interface, and the company says it knows of no malicious exploitation against its products.
Why It Matters
For boards and executives, the open question has shifted from whether the flaws can work to who has not yet patched. PHP's own advisory says the risk is highest for mod_php, the exact setup the honeypots used, and the version they ran was one release behind the fix. Exposure is broad: VirusTotal estimates, cited by BleepingComputer, put exposed PHP hosts above 5.1 million, while Unit 42's vendor telemetry counts more than 22.6 million exposed, potentially vulnerable instances. Both measure exposure, not compromises.
The fixed versions, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, have been out since Oct. 21. PHP's advisory tells administrators to restart every worker after configuration changes and says interim settings reduce exposure, but only updating fully fixes the flaws.
What to Watch
As of Monday, neither flaw appeared in the Known Exploited Vulnerabilities catalog kept by the Cybersecurity and Infrastructure Security Agency (CISA); its newest entries were dated Oct. 23. An addition would mark official confirmation of exploitation. Also watch for any company or agency confirming a breach, a PHP release fixing the separate flaw CVE-2026-115560, for which PHP's Oct. 23 guidance is to turn off session upload progress tracking, and Palo Alto's remaining hotfixes through Oct. 30.
