Pentester demonstrates live RCE via PHP2Shell exploit bypassing ASLR

1. Executive summary

A UK-based pentester, Jaydip Modhwadia ("Killa"), achieved remote code execution against a deliberately vulnerable public website on 2026-10-25 at 1547 UTC, claiming a Bitcoin prize offered by the site's operator to prove PHP2Shell could be exploited end to end. The target ran a vulnerable PHP version and, after the operator added a PHP endpoint on 2026-10-25, Modhwadia's single-file Python script reached RCE in roughly three hours using at most 20 HTTP requests. The exploit bypasses Address Space Layout Randomization, the protection that VulnCheck had identified as the main barrier to real-world exploitation of CVE-2026-109618, a critical out-of-memory corruption bug leading to RCE in PHP, disclosed with CVE-2026-109619 and patched by the PHP Foundation on 2026-10-21. No CVSS score, severity rating, EPSS estimate or CISA KEV entry is available for either CVE in the data supplied with this item, so this advisory does not assign one. The risk to EMEA financial services is concentrated in internet-facing PHP 8.4.x estates: a working, published, ASLR-bypassing exploit chain now exists, and the operator's own account of the contest shows the exploit is target-specific rather than a mass-automation tool.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The chain below is reconstructed from the two Register reports. The first report describes VulnCheck's exploit against CVE-2026-109618; the second describes Modhwadia's independent CTF solution. The sources do not state that the two are the same technique, and the CTF write-up itself was not available to this advisory, so the steps are the confirmed sequence of the CTF compromise, not a byte-level reproduction of Modhwadia's script.

1. The target served a vulnerable version of PHP. The exact version is not stated for the CTF host; VulnCheck's separate exploit was demonstrated on PHP 8.4.26.
2. The operator initially published only static HTML. Prospective attackers reported that this build could not reach RCE because the exploit path needs the site to serve a PHP file to use as a hook.
3. At approximately 1300 UTC on 2026-10-25 the operator added a PHP endpoint to the site.
4. Modhwadia ran a single-file Python script that issues at most 20 HTTP requests and reached RCE at 1547 UTC, exposing the PHP endpoint.
5. The exploit chain bypasses ASLR, which the earlier reporting had described as the principal obstacle to exploiting PHP2Shell on production-configured servers.

The underlying vulnerability pair is CVE-2026-109618 and CVE-2026-109619, disclosed and patched by the PHP Foundation on 2026-10-21. CVE-2026-109618 is an out-of-memory corruption bug that leads to RCE; the sources do not describe the mechanism of CVE-2026-109619 beyond naming it as the second half of the pair. VulnCheck's exploit chains a confirmed memory leak into RCE, works on x86-64 with ASLR enabled and with PHP's recommended display_errors=off production configuration, and is reported to work on ARM64 with the RCE not currently functional there. VulnCheck released it only to Initial Access Intelligence customers. The sources give no payload, persistence mechanism, command-and-control channel, privilege-escalation step, lateral-movement technique or post-exploitation behaviour for either exploit; both are proof-of-concept RCE demonstrations, and no in-the-wild post-compromise activity is described.

Two constraints on how far this generalises. Alon Gal, co-founder and CTO at Hudson Rock, told The Register that Modhwadia's success "was a sophisticated, target-specific exploit" and should not be read as evidence that autonomous agents can compromise arbitrary PHP servers at scale, while conceding it shows PHP2Shell "can be weaponized against a live target, even with meaningful technical constraints." The CTF operator had also imposed a 1MB request limit on Nginx, which did not prevent the compromise. Separately, the operator's site became effectively unusable under the volume of attempts once the contest went popular, which Modhwadia gave as the reason the challenge took 19 hours to fall; the real time from endpoint availability to RCE was under three hours.

Confidence caveats. The claim that exploit code was circulating hours or days before public disclosure, and that this produced millions of exploit attempts, is single-sourced to The Register's 2026-10-22 reporting and the efficacy of those attempts against real systems was not established. The count of "hundreds" of PHP2Shell proof-of-concept repositories on GitHub, of which "very few contain legitimate, working exploits," is VulnCheck's figure as quoted by The Register. The assertion that Modhwadia's solution is "more advanced" than earlier proofs of concept is the reporter's characterisation, not a technical comparison. No actor attribution is made anywhere in the sources and none is made here.

4. Mitigation & containment

P1 within 24h

• Inventory every internet-facing host running PHP and record the exact version. Patch any host on PHP 8.4.26 or any version the PHP Foundation's 2026-10-21 advisory lists as affected for CVE-2026-109618 and CVE-2026-109619. The sources do not enumerate the full affected range, so use the vendor advisory as the authority rather than the single version named in reporting.
• Where patching cannot complete inside 24 hours, remove the host from direct internet exposure or place it behind a WAF rule set that rejects requests matching the exploit's shape. The sources do not publish the request pattern, so this is a holding action, not a fix.
• Do not treat ASLR or display_errors=off as a control for this pair. VulnCheck's exploit works with both in place, and Modhwadia's CTF solution bypasses ASLR on a live target.

P2 within 72h

• Search web and application logs for POST and GET requests to PHP endpoints that arrive in tight bursts of up to roughly 20 requests from a single source, particularly where the response exposes a PHP endpoint or the request volume is inconsistent with normal application use. This is a behavioural hunt, not a signature; the sources give no atomic request indicators.
• Review any host that serves user-supplied files through PHP for the "hook" condition the CTF demonstrated: an endpoint that will include or execute a file the attacker can influence. The sources describe the requirement but not the parameter names.
• Confirm that Nginx client_max_body_size and equivalent request-size limits are set. Note that the CTF operator's 1MB limit did not stop the compromise, so treat this as defence in depth only.

P3 within 7 days

• Add PHP version to the asset inventory feed and alert on any host falling behind the PHP Foundation's security releases.
• Brief application owners that public proof-of-concept code for this pair exists and that "few working exploits" is a statement about GitHub repositories, not about the capability of a motivated attacker with a specific target.

5. Indicators of compromise

No indicators of compromise available in the source material. Neither report publishes a hash, domain, IP address, file path, registry key or command line. The only observable behaviours described are the request-volume pattern in §4 and the presence of a vulnerable PHP version; both are covered there rather than as atomic indicators.

6. Detection

Insufficient indicators to author detection rules. The sources name no distinctive strings, filenames, mutexes, command-line flags, registry keys or network artefacts belonging to the exploit. A rule built on the CVE identifiers or the "PHP2Shell" name would detect reporting about the vulnerability, not exploitation of it, and is not emitted.

7. Sources

• The Register, "UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest", https://www.theregister.com/security/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/5305429, 2026-10-26.
• The Register, "PHP2Shell exploit bypasses protections designed to stop remote code execution", https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883, 2026-10-22.

8. Adverse Trace position

Adverse Trace assesses this as a capability-development event rather than an active campaign: a working, ASLR-bypassing exploit for CVE-2026-109618 has been demonstrated against a live target, and a second independent researcher reached RCE on a hardened-by-constraint host in under three hours. We are not assigning a severity because no CVSS score, EPSS estimate or CISA KEV status is available for either CVE in the data we hold, and we will not infer one from press coverage. Client impact is limited to organisations running unpatched PHP 8.4.x on internet-facing systems; the sources describe no targeting of financial services and no in-the-wild post-exploitation. We will obtain the PHP Foundation advisory for the full affected version range and the CVE records for both identifiers, and reissue this note with verified scores and exploitation status when those are available. Clients who cannot confirm their PHP versions across internet-facing estates within 24 hours should contact us for triage support.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.