Honeypot captures 35 real shells using the PHP2Shell flaw
Remote code execution is now shown against PHP 8.4.26 with mod_php. Patches have been out since Oct. 21, and technical counts point to millions of hosts, not 100 million.
A researcher at Perplexity has logged 35 real shells on three honeypots, decoy servers, using the PHP2Shell flaw. Adel Karimi's report on GitHub, dated Oct. 24, documents remote code execution against PHP 8.4.26 running under mod_php, the module that runs PHP inside the Apache web server.
It is the first demonstration backed by network captures. Until now there had been exploit attempts and PHP crashes, but no confirmed execution. Each shell, a /bin/sh process launched by an Apache worker, matches a full POST request. Three came from one IP address and 32 from another, and no second-stage file download was seen. Two more IPs sent exploit-shaped requests with no confirmed execution.
The flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. PHP fixed them on Oct. 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The 7.4, 8.0 and 8.1 branches are affected and have no official fix; 8.1 and earlier no longer get updates from the project, so a fix depends on the Linux distribution or the hosting provider. watchTowr had already seen both exploited on Oct. 21 in its own honeypots.
Karimi's setup favors the attacker: a single mod_php worker and 128 MiB of memory. His report cautions that the numbers do not show how reliable the exploit is in other configurations, and they come from a single source. The security firm Sansec had warned on the 21st that public exploits fail against a default install and that nearly all of them need a second flaw in the application.
The 100 million figure
A claim is circulating that more than 100 million servers are exposed. PHP.net, watchTowr and Karimi's report do not contain it. Tenable's FAQ gives other estimates. Silas Cutler puts it, roughly, at more than 1.3 million potentially vulnerable hosts. Henk Poley counted more than 1.9 million hosts showing PHP on Shodan, with no distinction by version. Nobody has counted how many are actually vulnerable.
The bigger number appears to mix up usage and exposure. PHP runs on 69.3% of sites whose server-side language is known, according to W3Techs, as cited by Tenable. That says nothing about how many are unpatched and reachable.
For people who use these services rather than run them, the risk sits in the sites they visit and in devices such as NAS drives. QNAP has already acknowledged that its products use vulnerable PHP and has set no date for a fix. Neither CVE was in the CISA catalog of known exploited vulnerabilities as of Oct. 23.
