# What Are the PHP2Shell Vulnerabilities and Why Are They Being Actively Exploited?
## Overview
Security researchers have uncovered alarming activity surrounding a pair of critical vulnerabilities in PHP known as PHP2Shell. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to achieve remote code execution on servers running default PHP configurations — without needing any unusual application setup.
Since their public disclosure, these vulnerabilities have drawn widespread attention from both attackers and defenders across the globe.
—
## How Attackers Are Using AI in Post-Exploitation
One of the most striking developments is the use of agentic artificial intelligence platforms by attackers to carry out post-compromise operations. In a documented incident targeting a European government agency, intruders gained initial access through a vulnerable PHP application and quickly moved to exfiltrate sensitive data.
Within two hours of initial exploitation, the attackers obtained password hashes and multi-factor authentication secrets. They also set up a network relay tunnel into Active Directory and attempted to escalate privileges to domain administrator level.
What stood out to researchers was the structured nature of the attacker’s commands. Each batch of activity was organized with machine-readable section headers, such as markers for usernames and password data, suggesting an automated or AI-driven system was orchestrating the post-exploitation workflow.
The attacker conducted extensive reconnaissance of the compromised system, including queries against the authentication database, Active Directory lookups, and searches for internal hosts and privileged user groups.
—
## A Suspected North Korean Campaign
Separately, a cybersecurity firm called CYFIRMA identified a suspected campaign linked to North Korea that is actively scanning the internet for PHP systems vulnerable to PHP2Shell.
The campaign uses 21 compromised nodes to probe targets in a carefully controlled manner — keeping traffic low and rotating nodes when they get blocked. This slow-and-steady approach makes it difficult for automated defenses to flag the activity.
The targets span 216 unpatched or partially protected hosts across multiple countries, including the United States, Japan, South Korea, Australia, India, Singapore, the United Arab Emirates, Saudi Arabia, and the European Union. The affected organizations include government agencies, banks, financial platforms, logistics companies, airports, manufacturers, and online transaction services.
The activity is coordinated through a private network channel, and communications within it use vocabulary and spelling patterns consistent with North Korean language conventions. Two accounts previously associated with the Lazarus Group — a well-known cyber-espionage organization tied to North Korea — were active in these discussions.
Key indicators linking this campaign to Lazarus include infrastructure previously used by the group to exploit web servers, a history of planting web shells on PHP and WordPress systems, and a clear focus on government and financial targets.
The operators have stated they plan to shortlist the most promising targets and adapt public exploits accordingly, meaning further exploitation is expected in the near future.
—
## Probing and Testing by Other Actors
Beyond the North Korean campaign, other threat actors have been observed probing for PHP2Shell weaknesses. One security company reported seeing scanning attempts against its honeypot systems that mimic the behavior of mass exploitation campaigns. The probes included specific markers associated with PHP’s file upload mechanism, suggesting attackers are building target lists of vulnerable devices.
Massive scanning activity was also reported by a major content delivery network provider, which detected millions of exploitation attempts shortly after the vulnerabilities were publicly disclosed.
—
## How the Vulnerabilities Work
The PHP2Shell flaws exploit the way PHP handles form field names during file uploads. When an attacker submits a specially crafted request with a field name that is just the right size, it triggers a memory allocation failure during processing. This causes PHP to crash and, in the process, allows the attacker to inject and execute arbitrary code.
The exploit requires two technical conditions: the request must be sized precisely to cause a memory failure at the right moment, and the attacker must bypass address space layout randomization (ASLR) to locate valid memory addresses.
Researchers who reproduced one of the vulnerabilities in a lab environment identified a specific sequence of error messages that can help defenders detect exploitation attempts — including a POST request returning a 500 error, PHP reporting memory exhaustion, and the web server worker crashing.
—
## A Third Vulnerability on the Horizon
The PHP Foundation has also issued a warning about an additional remote code execution issue, tracked as CVE-2026-115560. This flaw requires an unusual combination of configuration settings and application code to be exploitable, but it still poses a risk to systems that match those conditions.
The Foundation noted that applications which never change their session serialization handler at runtime can continue safely using the session upload progress feature. However, systems that do modify this setting dynamically may need further attention.
—
## Who Is at Risk?
Internet-wide scanning data reveals that nearly 37 million systems are exposed and running PHP or PHP-related software. The highest concentrations of exposure are found in the United States, Germany, France, the Netherlands, and Japan.
Since PHP powers a vast portion of the web — from content management systems and e-commerce platforms to custom internal tools — the impact of these vulnerabilities is broad. Unlike application-level bugs, flaws in the PHP runtime cannot be fixed by updating a plugin or modifying application code. The only effective remedy is updating PHP itself on the host.
—
## How to Protect Against PHP2Shell Exploits
Organizations should take the following steps to reduce their exposure:
– **Update PHP immediately** to the latest patched version on all servers.
– **Scan for vulnerable versions** using available open-source tools designed to detect PHP2Shell exposure.
– **Monitor logs** for the specific sequence of errors associated with exploitation attempts, including memory exhaustion and worker crashes.
– **Restrict internet-facing PHP services** where possible and apply network-level controls to limit exposure.
– **Assume active targeting** if your organization operates in a prioritized sector such as government, finance, logistics, or aviation, particularly in affected geographic regions.
—
## FAQ
### What are the PHP2Shell vulnerabilities?
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are critical flaws in PHP that allow remote code execution on servers running default PHP configurations. They exploit how PHP processes file upload field names, causing memory allocation failures that can be leveraged by attackers.
### Who is behind the attacks?
Multiple threat actors have been observed probing for and exploiting these vulnerabilities. A suspected campaign linked to North Korea’s Lazarus Group has been actively scanning global infrastructure. Additionally, AI-driven post-exploitation activity has been documented targeting government agencies in Europe.
### How widespread is the exposure?
Nearly 37 million internet-facing systems run PHP or PHP-related software. The most exposed countries include the United States, Germany, France, the Netherlands, and Japan.
### Can web application firewalls (WAFs) protect against these vulnerabilities?
No. Because the flaws exist in the PHP runtime itself, WAFs or application-level plugins cannot fully prevent exploitation. Only updating PHP on the server closes the vulnerability.
### What should I do if I suspect my system has been compromised?
Investigate logs for signs of exploitation, such as memory exhaustion errors, unexpected 500 responses to POST requests, and anomalous LDAP or Active Directory queries. Engage a cybersecurity response team and patch PHP immediately.
### Is there a third PHP2Shell-related vulnerability?
Yes. CVE-2026-115560 is a separate remote code execution issue that requires an uncommon combination of configuration and application code to exploit. It is expected to be addressed in a future PHP release.
—
## Conclusion
The PHP2Shell vulnerabilities represent a significant threat to internet infrastructure due to their ease of exploitation and the sheer number of exposed systems. The combination of nation-state-level campaigns, AI-powered post-exploitation techniques, and broad internet scanning underscores the urgency for organizations to patch their PHP installations without delay. Defenders must remain vigilant, monitor for telltale signs of exploitation, and adopt a proactive stance toward securing PHP-dependent systems.
Thank you for reading
