PHP2Shell RCE patches issued after VulnCheck reveals AI-aided ASLR bypass on x86-64

PHP servers running x86-64 architectures face a new remote code execution threat that circumvents standard memory protections. VulnCheck researchers developed an exploit targeting the PHP2Shell vulnerability pair, specifically CVE-2026-109618. This out-of-memory corruption bug allows attackers to execute arbitrary code on systems that previously relied on Address Space Layout Randomisation for defence.

Root cause

The PHP2Shell issues stem from memory corruption flaws within the PHP interpreter. CVE-2026-109618 and its counterpart CVE-2026-109619 allow attackers to corrupt memory structures during request processing. VulnCheck described the new exploit as a significant advance because it overcomes ASLR, a mechanism that randomly arranges memory locations to prevent predictable code execution.

Attack path

Attackers can now achieve remote code execution on ASLR-enabled servers using PHP’s recommended production configuration. According to The Register, VulnCheck believes this is the first known exploit to succeed in this specific environment. Researchers noted that while hundreds of proof-of-concept repositories exist on GitHub, very few contained working exploits due to the ASLR barrier.

Affected versions

The PHP Foundation officially disclosed and issued patches for both CVE-2026-109618 and CVE-2026-109619 on Wednesday. The vulnerabilities affect PHP installations that did not apply these updates prior to the disclosure. UK government websites proactively went dark as part of the response to the growing threat landscape.

Mitigation

• Apply the patches released by the PHP Foundation for both CVE-2026-109618 and CVE-2026-109619 immediately.
• Verify that all PHP instances are running the updated versions on x86-64 servers.
• Monitor for any unauthorised changes to server configurations or file systems.
• Review access logs for signs of exploitation attempts against PHP endpoints.

Signals worth monitoring

Teams should examine web server logs for unusual request patterns targeting PHP endpoints. Look for spikes in error rates or unexpected memory usage that may indicate exploitation attempts. Check for new files or processes spawned by the web server user. Inspect network traffic for outbound connections to unknown IP addresses. Verify that application integrity checks detect any modifications to core PHP binaries. Monitor for signs of lateral movement within the network segment hosting web services.

What to do and how to stay safe: PHP

• Check your inventory for any PHP servers running on x86-64 hardware that have not been patched.
• Review firewall rules to restrict access to PHP management interfaces from untrusted networks.
• Enable detailed logging on web servers to capture potential exploitation attempts for forensic analysis.
• Once the vendor provides an update, test it in a staging environment before deploying to production systems.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does the PHP2Shell exploit work on systems with ASLR enabled?

Yes, VulnCheck researchers demonstrated an exploit that bypasses Address Space Layout Randomisation on x86-64 servers.

When were patches for the PHP2Shell vulnerabilities released?

The PHP Foundation issued patches for both CVE-2026-109618 and CVE-2026-109619 on Wednesday.

Are threat actors actively using these vulnerabilities?

Reports indicate attackers abused the flaws days before disclosure, and researchers warn they are using AI to find more attack vectors.