PHP2Shell exploitation observed: packet-to-process RCE evidence
Security researchers have confirmed remote code execution attacks exploiting PHP2Shell vulnerability across multiple targets on October 24, 2026.
Security researchers have confirmed successful remote code execution (RCE) attacks exploiting a PHP2Shell vulnerability across multiple targets on October 24, 2026. The attacks were observed through packet captures and process monitoring, showing exploitation of PHP 8.4.26 running under Apache mod_php with a 128 MiB memory limit.
The attacks originated from two distinct IP addresses: 15.204.59.70 and 162.35.99.94, registered to OVH US LLC and Interserver, Inc respectively. While these represent two separate source-address clusters, researchers cannot definitively attribute them to different actors due to similarities in exploit methodology.
Exploit methodology
The attackers employed a sophisticated four-stage multipart HTTP POST chain to achieve RCE. The sequence involved memory pressure, memory disclosure through oversized PHPSESSID cookies, additional memory pressure, and finally a target-adjusted execution stage. The requests used HTTP/1.1 with multipart boundaries and specific header patterns.
The memory disclosure stage generated cookies containing 819,200 bytes each, with pointer-like values that helped attackers adjust to each target's randomized memory layout (ASLR). This technique aligns with public PHP2Shell research and CVE-2026-109618, though the specific exploit implementation remains unclear.
The shared template, boundary, body hashes, and stage order do not establish shared control. Nor do different source IPs and proof commands establish separate actors. The defensible finding is two source-address episodes using closely related tooling.
Attack patterns
The first source (15.204.59.70) produced three confirmed shells between 15:35 and 16:04 UTC, all using identical final-stage commands. The second source (162.35.99.94) was more aggressive, generating 32 confirmed shells across three targets between 16:46 and 18:57, with varying commands using PHP CLI, curl, and wget.
Both sources used byte-identical first three request bodies, confirming they employed the same exploit template. The final stage (B2) varied based on target-specific memory leaks and commands, demonstrating the exploit's adaptability.
Additional IP addresses (104.28.208.84 and 144.48.4.242) sent exploit-shaped requests but did not achieve confirmed RCE, indicating they may have been using incomplete or modified versions of the exploit.
Technical evidence
Researchers analyzed 3,459 sealed segments and 10,948 files (11.21 GB) of evidence, including packet captures, Apache requests, and process events. They correlated 35 complete execution-stage HTTP POSTs with 35 /bin/sh processes started directly by Apache workers.
The evidence chain was established by matching packet flows to application and process records through source port, time, worker identity, and request sequence. No single alert or HTTP status was treated as proof of execution, requiring complete packet-to-process correlation.
The attacks targeted disposable PHP honeypots presenting ordinary PHP-backed pages. All relevant PHP errors occurred during request startup before application code execution, indicating a PHP-engine vulnerability rather than a flaw in specific content management systems.
Related
