New PHP2Shell Exploit Bypasses ASLR on x86-64 Servers
VulnCheck researchers demonstrated a working exploit for the critical PHP memory corruption flaw that circumvents standard server protections, raising concerns about AI-assisted attacks.
Key points
- VulnCheck developed an exploit for CVE-2026-109618 that achieves remote code execution on ASLR-enabled x86-64 systems.
- The PHP Foundation issued patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday following pre-disclosure abuse.
- Researchers warn that adversaries are using artificial intelligence to accelerate the discovery of new attack vectors against this vulnerability.
A new exploit technique allows attackers to bypass Address Space Layout Randomization (ASLR) on x86-64 servers running PHP, enabling remote code execution through the critical PHP2Shell vulnerability. VulnCheck researchers confirmed they developed the first known working exploit that functions against PHP’s recommended production configuration, overcoming a major defense mechanism that previously blocked most attempts.
How does this exploit bypass ASLR protections?
Address Space Layout Randomization scrambles memory locations every time a program runs, preventing attackers from guessing the correct memory address needed to execute malicious code. VulnCheck stated that their new technique successfully bypasses this barrier on x86-64 systems. Spencer McIntyre, director of exploit development at VulnCheck, told The Register that this represents a significant advance because ASLR had been the primary obstacle for real-world exploitation of PHP2Shell.
What is the status of the PHP2Shell vulnerabilities?
The PHP Foundation officially disclosed and issued patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday. CVE-2026-109618 is a critical out-of-memory corruption bug that leads to remote code execution. According to The Register, attackers abused these security flaws days before they were publicly disclosed, leading to dozens of UK government services proactively going offline.
Why are researchers concerned about AI involvement?
VulnCheck warned that threat actors are using artificial intelligence to find even more ways to attack PHP servers. McIntyre noted that adversaries are spending significant time and tokens on this specific bug. While hundreds of proof-of-concept repositories exist on GitHub, very few contain legitimate, working exploits due to the ASLR barrier, making this new bypass particularly dangerous for unpatched systems.
What should developers do next?
The PHP Foundation has issued patches for both CVE-2026-109618 and CVE-2026-109619. Developers should apply these updates immediately to protect their servers from remote code execution. Given that attackers were exploiting the flaws before disclosure, organizations should verify their patch status and monitor for any signs of compromise on systems running PHP in production environments.
What analysts watch for
Teams usually examine server logs for unusual memory access patterns or unexpected process spawning that may indicate an exploit attempt. Analysts check whether ASLR is correctly enabled and functioning on x86-64 systems, as misconfigurations can weaken defenses. They also look for signs of artificial intelligence-assisted reconnaissance, such as rapid, automated scanning from diverse sources. Reviewing proof-of-concept code for new bypass techniques helps anticipate future threats.
What to do and how to stay safe: PHP
- Apply the latest PHP Foundation patches for CVE-2026-109618 and CVE-2026-109619 immediately to close the remote code execution gap.
- Verify that Address Space Layout Randomization is enabled and functioning correctly on all x86-64 servers running PHP in production.
- Monitor server logs for suspicious activity, such as unexpected memory corruption events or unauthorized code execution attempts.
- Review access controls and limit exposure of PHP services to reduce the attack surface for potential exploit attempts.
Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this exploit work on all PHP servers?
The exploit developed by VulnCheck targets ASLR-enabled x86-64 systems running PHP with recommended production configurations, according to The Register.
Are patches available for PHP2Shell?
Yes, the PHP Foundation issued patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday, as reported by The Register.
Is this vulnerability being actively exploited?
Yes, attackers abused the security flaws days before they were disclosed, leading to UK government websites going dark, according to The Register.
