On October 25, 2026, Unit 42 withdrew its earlier link between PHP2Shell and initial access in an attack on a European government agency, saying it could not confirm that either vulnerability was involved. A separate report by Adel Karimi, dated October 24, recorded 35 shell starts across three honeypots.
Unit 42 withdrew its earlier attribution
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. Unit 42’s October 25 update said it could not confirm that initial access in the government-agency case involved either CVE, and withdrew its earlier linkage. The correction is about the proposed route into that incident.
What the honeypots recorded
Karimi’s report correlated 35 execution-stage HTTP requests with 35 starts of /bin/sh processes parented by Apache workers. The three decoy systems ran PHP 8.4.26 with Apache mod_php, a single worker, and a 128 MiB PHP memory limit.
Those 35 shell starts were recorded on honeypots, not production servers. The setup was Apache mod_php; PHP-FPM was not part of the reported test configuration.
NeoTeo previously covered Amazon’s report of a PHP2Shell attempt against its MadPot honeypot. That was a separate honeypot observation, distinct from both Karimi’s report and the government-agency case.
The PHP project’s fixed releases
On October 21, the PHP project published fixes for both vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These are the project’s listed fixed releases.
