PHP2Shell exploit bypasses protections designed to stop remote code execution

Researchers have devised an exploit that demonstrates how even Address Space Layout Randomization (ASLR) on an x86-64 server cannot prevent the PHP2Shell vulnerability from being exploited. The security team, VulnCheck, only shared this exploit with their Initial Access Intelligence customers. They warned that AI is being used to discover more ways to attack systems.

The team stated that this is a "significant advance" as ASLR has previously been a major obstacle for exploiting PHP2Shell on real servers. The exploit targets CVE-2026-109618, a critical out-of-memory corruption bug leading to remote code execution (RCE) in PHP. This vulnerability is a part of the PHP2Shell pair alongside CVE-2026-109619.

VulnCheck's exploit works on ASLR-enabled x86-64 systems with PHP's recommended production configuration. ASLR is a defense mechanism that randomizes memory locations, preventing attackers from executing malicious code by guessing memory addresses. The researchers claimed that their technique bypasses ASLR and works even with PHP's recommended display_errors=off production configuration.

This exploit works on x86-64 platforms but not currently on ARM64 systems, although the RCE is functional in that environment. This revelation serves as a warning to organizations that the technical difficulty of exploiting a vulnerability should not be underestimated, as the presence of memory protections or configuration changes does not guarantee protection against attacks.