PHP2Shell exploit bypasses protections designed to stop remote code execution

A fresh exploit has surfaced that demonstrates the PHP2Shell vulnerability can bypass defenses meant to prevent remote code execution (RCE) on x86-64 servers, according to VulnCheck researchers. The vulnerability, CVE-2026-109618, is a critical out-of-memory corruption bug that allows RCE in PHP and is part of the PHP2Shell pair alongside CVE-2026-109619.

Despite ASLR, a memory-randomization technique that scrambles key data areas in memory to thwart RCE attempts, the new exploit reportedly works on ASLR-enabled systems with PHP's standard production configuration. The researchers claim this is a "significant advance" because ASLR has typically been a strong barrier to exploiting PHP2Shell in real-world scenarios.

VulnCheck's director of exploit development, Spencer McIntyre, stated that the exploit leverages a memory leak and can execute RCE on x86-64 platforms even when ASLR is enabled and PHP's display_errors=off setting is in place. This development highlights the growing threat of AI-assisted attacks, as threat actors are rapidly finding new ways to exploit vulnerabilities.

McIntyre warns that organizations should prioritize patching vulnerable PHP versions, as the technical difficulty of exploiting a vulnerability should not be underestimated, emphasizing the importance of robust security measures even with advanced memory protection technologies in place.