VulnCheck Develops PHP2Shell Exploit That Bypasses ASLR on Production Systems

Security researchers at VulnCheck have developed an exploit for the PHP2Shell vulnerability that bypasses Address Space Layout Randomization (ASLR) on x86-64 servers running PHP's recommended production configuration. The exploit targets CVE-2026-109618, a critical out-of-memory corruption bug that leads to remote code execution in PHP, which forms part of the PHP2Shell pair alongside CVE-2026-109619.

Technical Details of the Exploit

The PHP Foundation officially disclosed and issued patches for both vulnerabilities on October 21, 2026. VulnCheck researchers developed their exploit overnight, achieving what they believe is the first known remote code execution on ASLR-enabled x86-64 systems with PHP 8.4.26 and the recommended display_errors=off production setting. The technique uses a confirmed memory leak chained into remote code execution. While the exploit also works on ARM64 platforms, the remote code execution component is not currently functional on ARM-based systems.

ASLR is a built-in defense against memory-corruption bugs that randomly arranges memory locations of a program's key data areas each time it runs. This prevents attackers from correctly guessing target memory addresses needed to execute malicious code. Until now, ASLR has been a major barrier to exploiting PHP2Shell on real-world servers. Spencer McIntyre, director of exploit development at VulnCheck, stated that developing this capability was far from trivial but demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome.

Implications for Organizations

McIntyre warned that organizations running vulnerable versions of PHP should prioritize patching rather than assume existing memory protections or configuration changes will stop an attack. He emphasized that the technical difficulty of exploiting a vulnerability should not be confused with protection against it, especially in the current era of AI-assisted bug hunting and exploit development. VulnCheck has made the exploit available only to its Initial Access Intelligence customers.

AI-Assisted Threat Development

VulnCheck also warned that threat actors are using AI to find additional ways to attack the PHP2Shell vulnerabilities. McIntyre noted that adversaries are clearly spending time and computational resources on this bug. The company has observed hundreds of PHP2Shell proof-of-concept repositories on GitHub, though very few contain legitimate working exploits, largely due to ASLR. The situation has escalated with reports of attackers abusing the security flaws days before they were disclosed, and UK government websites proactively going dark in response to the threat.

Earlier coverage: PHP2Shell patches are out: what is at risk and how to protect PHP sites · Hackers Exploited PHP Vulnerabilities Days Before Patches Were Released

Sources: The Register