Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
PHP2Shell vulnerabilities see rising exploitation attempts, but experts say most PoCs fail in real-world conditions.
Two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), dubbed PHP2Shell, are attracting widespread exploitation attempts dating back to October, with Amazon, Sophos, Google, and others reporting activity. However, dozens of security experts contend that nearly all attempts have failed and that publicly available proof-of-concept exploits only work in lab environments, not on properly configured production systems. The main barrier is ASLR (Address Space Layout Randomization), though VulnCheck has developed a novel bypass technique, and experts warn that patching vulnerable systems remains critical.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have attracted widespread exploitation attempts, though most have failed against properly configured production systems due to ASLR. This incident illustrates that even when environmental mitigations reduce immediate risk, unpatched systems remain a ticking clock — as demonstrated by VulnCheck's novel ASLR bypass technique, which proves viable exploitation is a matter of time and attacker ingenuity. Organizations that delay patching because exploits 'seem unlikely to succeed' are gambling on a shrinking window of protection. The case also underscores that security hardening measures like ASLR are a defense-in-depth layer, not a substitute for prompt patching.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619
- malware — Potassium botnet
- malware — Mirai botnet