PHP2Shell Exploit Bypasses Protections Designed to Stop Remote Code Execution

PHP2Shell exposes the weakness in coordinated vulnerability disclosure

Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure. According to The PHP Foundation, several organizations had agreed to a coordinated release detailing the critical flaws and mitigation actions, but cybersecurity firm Chainguard “unlaterally” broke this embargo.…

PHP2Shell clears a major real-world barrier

Researchers at VulnCheck say they developed the first known exploit for CVE-2026-109618 that achieves remote code execution on ASLR-enabled x86-64 systems running PHP 8.4.26 with the recommended production setting display_errors=off. The chain...

PHP2Shell exploit bypasses protections designed to stop remote code execution

Researchers have developed a new exploit that shows how even Address Space Layout Randomization (ASLR) on an x86-64 server cannot stop the PHP2Shell vulnerability. VulnCheck, which made it available to only the company’s Initial Access Intelligence customers, also warned that threat actors are using AI to find even more ways to attack. The team told us that it’s a “significant advance” because up until now, ASLR has been a major barrier to explo…