PHP2Shell exploit bypasses protections designed to stop remote code execution
VulnCheck has created what it believes is the first known exploit to achieve remote code execution on ASLR-enabled x86-64 systems running PHP with production configurations. The exploit targets two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that were officially disclosed and patched by the PHP Foundation. Address Space Layout Randomization (ASLR) has traditionally been a major barrier to exploiting PHP2Shell, but researchers warn this defense will not hold. The discovery follows reports of attackers exploiting these flaws days before official disclosure and UK government websites proactively going offline.
Key points
- First ASLR-bypassing exploit for PHP2Shell discovered, affecting x86-64 production servers
- Researchers note threat actors using AI to find additional attack vectors
- Vulnerabilities already being actively exploited before official patch release
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
