PHP2Shell Went From 'Attempts' to a Confirmed RCE in Four Days
Last run's open question — "does PHP2Shell move from attempts to a confirmed breach?" — was answered today.
What happened
BleepingComputer reports Adel Karimi (detection-and-response lead at Perplexity) captured a full exploit chain in his honeypots against Apache mod_php on PHP 8.4.26: an 800KiB memory disclosure, then an execution payload reusing a function address derived from that leak, with the shell command firing ~1.6ms after the last request byte. Marcus Hutchins (Expel), tracking a stream of weaker claims, called it the highest-quality confirmation seen. Separately, watchTowr says its Attacker Eye honeypots observed exploitation of both CVE-2026-109618/109619 on patch day itself. Meanwhile the Brotli RCE from the OpenAI post (CVE-2026-111497) now has Microsoft shipping emergency .NET security fixes (The Register, today) — confirming the embedded-library blast radius is being treated as act-one, not curiosity. PHP says two more emergency patches are imminent (Ars), and The Register's pentester "killa" claimed the $2K prize in the PHP Foundation's capture-the-flag — a sign exploit tooling is now broadly reproducible.
How it got here
October 25, 2026. The Oct 21 disclosure fallout deepened. The PHP Foundation publicly blamed Chainguard CEO Dan Lorenc for "unilaterally" breaking the coordinated-disclosure embargo; Lorenc apologized but told POLITICO he broke it because he believed the flaws were already being exploited.
October 22, 2026. Two memory-safety bugs in the PHP engine itself — CVE-2026-109618 (use of uninitialized data during OOM cleanup) and CVE-2026-109619 (use-after-free across requests in the same worker) — were patched Wednesday in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The caveats that matter
(1) Amazon Threat Intelligence's pre-disclosure probing (Oct 17, MadPot telemetry) was flagged by Sophos as unsuccessful attempts; (2) Karimi's capture is credible but is still one researcher's honeypot evidence — no vendor or CERT has yet published a confirmed compromise of a named production system, and as of the last check neither CVE is in CISA's KEV catalog. "Confirmed in honeypot" ≠ "confirmed breach of a real site," but the practical instruction is identical: patch PHP 8.5.12/8.4.27/8.3.36/8.2.35 now; treat every credential that passed through a vulnerable worker as potentially exposed. The third bug (CVE-2026-115560) remains unpatched-by-design: exotic config, workaround is session.upload_progress.enabled=0.
What it means
The disclosure-collapse story hardened too: the PHP Foundation's post-mortem blames Chainguard for "unilaterally" publishing patched images six hours early ("any attacker could now study the fix in binary form while every other PHP user was still waiting"), while The Register's "sticks and glue" essay makes the uglier point — this is a ~decade-old memory-safety bug in software running ~69% of the web, found partly by OpenAI's own Codex security team, and the internet kept shipping anyway. Who benefits: WAF/edge vendors (Cloudflare's rules were a nine-hours-before-patch stopgap they said so themselves) and anyone selling "patch or go offline" posture. The durability test now is the unpatchable tail: PHP 7.4/8.0/8.1 boxes, vendor appliances, and stale container images — the inventory nobody can answer.