{
  "id": 16107547,
  "title": "PHP2Shell exploit bypasses protections designed to stop remote code execution",
  "url": "https://urgent.news/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code",
  "topic": "science",
  "section": "Science",
  "published": "2026-10-22T20:37:52.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883"
  },
  "original_language": "en",
  "account": "A fresh exploit has surfaced that demonstrates the PHP2Shell vulnerability can bypass defenses meant to prevent remote code execution (RCE) on x86-64 servers, according to VulnCheck researchers. The vulnerability, CVE-2026-109618, is a critical out-of-memory corruption bug that allows RCE in PHP and is part of the PHP2Shell pair alongside CVE-2026-109619. Despite ASLR, a memory-randomization technique that scrambles key data areas in memory to thwart RCE attempts, the new exploit reportedly works on ASLR-enabled systems with PHP's standard production configuration. The researchers claim this is a \"significant advance\" because ASLR has typically been a strong barrier to exploiting PHP2Shell in real-world scenarios. VulnCheck's director of exploit development, Spencer McIntyre, stated that the exploit leverages a memory leak and can execute RCE on x86-64 platforms even when ASLR is enabled and PHP's display_errors=off setting is in place. This development highlights the growing threat of AI-assisted attacks, as threat actors are rapidly finding new ways to exploit vulnerabilities. McIntyre warns that organizations should prioritize patching vulnerable PHP versions, as the technical difficulty of exploiting a vulnerability should not be underestimated, emphasizing the importance of robust security measures even with advanced memory protection technologies in place.",
  "summary": "“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}