VulnCheck Exploit Bypasses ASLR in Critical PHP2Shell Vulnerability
VulnCheck researchers developed an exploit for the critical PHP2Shell vulnerability (CVE-2026-109618) that bypasses Address Space Layout Randomization on x86-64 servers. This advance allows remote code execution even with PHP's recommended production settings. The PHP Foundation patched the flaws on Wednesday, but attackers had already begun abusing them. The development highlights growing reliance on AI for vulnerability discovery and increases urgency for global web infrastructure updates.
Key points
- VulnCheck, a security firm, released an exploit for CVE-2026-109618, a critical out-of-memory corruption bug in PHP that enables remote code execution.
- The exploit is significant because it achieves remote code execution on ASLR-enabled x86-64 systems using PHP's standard production configuration, overcoming a major historical barrier.
- The PHP Foundation officially disclosed and patched both CVE-2026-109618 and its pair, CVE-2026-109619, on Wednesday, though attackers had abused the flaws days earlier.
- Spencer McIntyre, director of exploit development at VulnCheck, noted that adversaries are using AI to accelerate vulnerability discovery, describing the new exploit as a significant advance.
- UK government websites proactively went dark as the threat grew, while VulnCheck initially shared the exploit with its Initial Access Intelligence customers.
- The vulnerability pair, known as PHP2Shell, poses a widespread risk to global web infrastructure due to PHP's prevalence in server-side applications.
Security researchers at VulnCheck have demonstrated a new exploit for the critical PHP2Shell vulnerability that successfully bypasses Address Space Layout Randomization (ASLR) on x86-64 servers. This development marks a significant shift in the landscape of remote code execution (RCE) threats, as ASLR has traditionally served as a primary defense against memory-corruption bugs. The exploit targets CVE-2026-109618, an out-of-memory corruption flaw, and achieves RCE even when PHP is configured with its recommended production settings. VulnCheck’s team described the advance as a major hurdle overcome, noting that adversaries are increasingly leveraging artificial intelligence to identify and exploit such complex vulnerabilities.
The PHP Foundation officially disclosed and issued patches for both CVE-2026-109618 and its companion flaw, CVE-2026-109619, on Wednesday. However, the timeline suggests the threat was already active, with reports indicating that attackers began abusing the security flaws days before the official disclosure. In response to the escalating risk, some UK government websites proactively went dark to minimize exposure. Spencer McIntyre, director of exploit development at VulnCheck, emphasized that the new exploit targets the most common server configurations, making the threat particularly relevant for global web infrastructure.
VulnCheck initially made the exploit available to its Initial Access Intelligence customers, providing a head start for those with advanced threat monitoring capabilities. The reliance on AI for vulnerability discovery suggests that future exploits may emerge more rapidly, compressing the window for developers to patch and deploy updates. For organizations relying on PHP, the combination of critical severity and the bypass of standard defenses like ASLR underscores the need for immediate patching and continuous monitoring to mitigate the risk of remote code execution.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
