Perplexity Researcher Adel Karimi Reports First Successful Exploitation of PHP2Shell Vulnerabilities in Honeypots
Perplexity researcher Adel Karimi reported detecting the first successful exploitation of PHP2Shell vulnerabilities in honeypot traps on October 24, where attackers executed arbitrary code using a four-stage memory pressure technique. Prior coverage indicated no known public exploits existed.
Last week, the PHP development team announced and patched major security vulnerabilities collectively known as PHP2Shell (CVE-2026-109618, CVE-2026-109619). Security firms Wiz and Calif, who discovered these flaws, had previously noted that without AI assistance, researchers would have struggled to find vulnerabilities with actual destructive power, and most reported active exploitation attempts were limited to reconnaissance. However, recent observations in self-hosted honeypot traps indicate that attackers have successfully exploited the vulnerability.
Perplexity researcher Adel Karimi stated that between 19:26 and 19:31 UTC on October 24, he detected successful exploitation of PHP2Shell through six sensors in honeypot traps. Attackers executed 35 shell processes in total, launching /bin/sh via specific Apache processes in a honeypot running PHP 8.4.26 with Apache mod_php. This marks the first time anyone has successfully exploited PHP2Shell to achieve arbitrary code execution.
Regarding attack sources, the activity originated from two IP addresses: 15.204.59[.]70 and 162.35.99[.]94. One IP address triggered only three shell executions, while the other exhibited more diverse activities, including the use of tools such as PHP CLI, curl, and wget, followed by dynamic identity checks. Although both IP addresses shared templates and body hash characteristics, they did not share a control mechanism. Adel indicated that it remains unclear whether these actions were carried out by the same group or initiated by different attackers.