Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Multiple companies report increased exploitation attempts against two PHP vulnerabilities, but experts say most proof-of-concept exploits only work in ideal lab conditions.
The two PHP vulnerabilities known as CVE-2026-109618 and CVE-2026-109619, or PHP2Shell, have triggered a wave of exploitation attempts this week. While multiple large companies have reported an explosion in such attempts, dozens of cybersecurity experts have found no evidence of successful exploits, noting that most available proof-of-concept (PoC) exploits only function in ideal laboratory conditions.
Mixed reports from security firms
Amazon's security team reported seeing exploitation attempts dating back to October 17, days before the vulnerabilities became public knowledge. Sophos initially reported successful exploitation but later retracted that statement, confirming they were only witnessing "a small number of failed exploitation attempts." Google's John Hultquist noted his team hasn't validated exploitation in the wild but acknowledged that "exploitation may have already begun in a limited fashion and the threat is viable and very serious."
exploitation may have already begun in a limited fashion and the threat is viable and very serious
Technical barriers to exploitation
Researchers have linked exploitation attempts to botnets like Potassium and Mirai, with attackers seeking to infect devices with malware for DDoS networks. Spencer McIntyre from VulnCheck noted that many PoCs circulating are "garbage and nonfunctional" and only work in developer environments or on production apps with atypical PHP configurations.
Address space layout randomization (ASLR) has proven to be a significant barrier for many exploit attempts. "There's a significant difference between demonstrating a vulnerability and developing an exploit that can overcome the security protections found in real-world environments," McIntyre explained. While his team has developed a technique to bypass ASLR, no other public or commercial exploit currently does so.
Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome
Defensive time window
Marcus Hutchins from Expel suggested the difficulty in developing reliable exploits may buy defenders some time, though he couldn't predict how long this advantage would last. He distinguished between sophisticated, targeted exploitation attempts and mass exploitation attempts using non-functional PoCs. "The second case matches the evidence I've personally seen," Hutchins said.
Despite ASLR hindering mass exploitation attempts, experts warned it's not a permanent barrier and urged organizations to patch vulnerable systems immediately. Hutchins emphasized that while ASLR isn't a "significant barrier" to successful exploitation, it does complicate large-scale attacks, giving security teams a crucial window to protect their systems.
Related
