EXPLORINEER
en

UK — The Register

PHP2Shell exploit bypasses protections designed to stop remote code execution

Security1 min read

Researchers at VulnCheck built a working exploit for the PHP2Shell bug that gets past ASLR, a memory defense that had been slowing attackers down. Organizations running vulnerable PHP should patch now.

A new way past a key defense

VulnCheck, a security company, says it has built the first known exploit that can run malicious code on certain servers. Those servers use ASLR, a security feature that hides where data sits in memory, and they use PHP's recommended production settings. The company shared the exploit only with its own paying customers.

Key facts

  • The bug is CVE-2026-109618. It is rated critical and can allow remote code execution, which means an attacker can run their own code on a server from far away.
  • It is one half of the PHP2Shell pair. The other bug is CVE-2026-109619.
  • The PHP Foundation disclosed both bugs and released patches on Wednesday.
  • The exploit works on PHP 8.4.26 on x86-64 systems. VulnCheck says it also works on ARM64, but the code execution does not work yet on ARM systems.

What is ASLR?

ASLR stands for Address Space Layout Randomization. Each time a program runs, it moves its important memory areas to random spots. An attacker who wants to run code must guess the right spot. If the guess is wrong, the attack fails. Until now, this randomness had been a big barrier to attacking PHP2Shell on real servers.

Why it matters

Many people thought ASLR and standard settings would keep servers safe. This exploit shows that they may not. The researchers say attackers are already working hard on this bug, and AI tools may help them find more ways in. Experts say the difficulty of an attack is not the same as protection from it, so patching is the best step.

What to watch

  • Whether attackers start using this exploit in real attacks.
  • Whether a fix for the ARM64 version is released.
  • How quickly website owners install the PHP patches.

Glossary

ASLR
A security feature that moves key memory areas to random spots so attackers cannot easily guess where to strike.
PHP2Shell
The name for a pair of PHP bugs that can let attackers run code on a server.
VulnCheck
A security company that finds and tracks software bugs and sells threat intelligence to customers.
PHP
A popular programming language used to build many websites and web servers.
x86-64
A common type of computer processor design used in many servers and PCs.

Same story, different eyes

More in this topic

Security전자신문

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

SecurityVnExpress

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.

Security전자신문

Election Deepfakes Up 27% Worldwide; South Korea Ranks Third in Cumulative Cases

Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.