“Adversaries are clearly spending time (and tokens) on this bug,” Spencer McIntyre, director of exploit development at VulnCheck, told The Register.
VulnCheck's exploit targets CVE-2026-109618 and defeats production PHP settings
Researchers at VulnCheck built an exploit that targets CVE-2026-109618, a critical out‑of‑memory corruption bug that leads to remote code execution (RCE) in PHP and forms one half of the PHP2Shell vulnerability pair alongside CVE-2026-109619. VulnCheck says the new technique chains a confirmed memory leak into RCE on PHP 8.4.26 and — crucially — achieves RCE on x86‑64 servers even when Address Space Layout Randomization (ASLR) is enabled and PHP is configured with the recommended production setting display_errors=off.
The company described the result as a “significant advance,” saying that, up until now, ASLR represented a major barrier to practical exploitation of PHP2Shell on real‑world servers. VulnCheck developed the capability overnight after the PHP Foundation released official disclosures and patches, and the exploit was made available only to the company’s Initial Access Intelligence customers.
How the technique undercuts ASLR on x86‑64
ASLR is a memory‑randomization defense that scrambles key program memory regions so an attacker cannot reliably guess addresses required for code execution. VulnCheck says its exploit bypasses that protection by leveraging a confirmed memory leak that provides the information necessary to overcome ASLR’s randomness and then chaining that into an RCE primitive on PHP 8.4.26.
McIntyre emphasized the technical gap between proof‑of‑concept material and true, production‑grade exploits: while VulnCheck has seen “hundreds” of PHP2Shell proof‑of‑concept repositories on GitHub, “very few contain legitimate, working exploits,” a shortfall the company attributes largely to ASLR. VulnCheck also said it has not identified another public or commercial exploit that achieves RCE under the same conditions — ASLR enabled and PHP in its recommended production configuration.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDisclosure, patching, and active exploitation
The PHP Foundation officially disclosed and issued patches for both CVE‑2026‑109618 and CVE‑2026‑109619 on Wednesday. Despite the patches, the PHP2Shell situation escalated on Thursday amid reports that attackers were abusing the security flaws days before public disclosure and that UK government websites had proactively gone dark.
VulnCheck’s timeline is notable: researchers produced what they describe as the first known exploit capable of RCE on ASLR‑enabled x86‑64 systems soon after the official disclosure and then limited distribution to a subset of customers focused on initial access intelligence.
What this means for technologists, affected enterprises, and threat actors
- Technologists and security teams: The exploit demonstrates that ASLR and turning off display errors are not, by themselves, adequate mitigations for this bug. VulnCheck’s advice — echoed in its description of the work — is to prioritize patching vulnerable PHP instances rather than assuming configuration‑level protections will prevent exploitation.
- Affected enterprises and procurement leaders: The rapid development of a production‑grade exploit after disclosure, combined with reports of pre‑disclosure abuse, means organizations should accelerate deployment of the PHP Foundation’s patches for both CVEs and treat vulnerable PHP 8.4.26 instances as high‑priority remediation targets.
- Adversaries and threat actors: VulnCheck warned that threat actors are using AI to find “even more ways to attack,” and McIntyre noted adversaries are spending tokens and time on the bug — an explicit signal that exploitation effort and automation are increasing.
Closing observation
VulnCheck’s work closes a formerly significant technical gap — ASLR on x86‑64 — but it also leaves a straightforward operational takeaway: do not mistake the technical difficulty of crafting an exploit for an actual defense. As McIntyre put it, “the technical difficulty of exploiting a vulnerability shouldn't be confused with protection against it.” Organizations running vulnerable versions of PHP should prioritize applying the PHP Foundation’s patches for CVE‑2026‑109618 and CVE‑2026‑109619 rather than relying on memory protections or production configuration settings alone.
