# Researchers defeat ASLR to exploit PHP2Shell flaw on x86-64 servers

- URL: https://talkfuse.com/story/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/
- Published: 2026-10-22T20:37:52+00:00
- Updated: 2026-10-22T22:52:49+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883
- Topics: Software

## Key points

- VulnCheck bypassed ASLR to exploit PHP2Shell on x86-64 servers.
- The exploit works on PHP 8.4.26 with production settings.
- Organisations should patch vulnerable PHP versions promptly.

## Summary

Researchers at VulnCheck have developed an exploit that can use the PHP2Shell vulnerability to run code remotely on x86-64 servers despite address space layout randomisation (ASLR) and PHP’s recommended production settings. The finding matters because ASLR had been a major obstacle to exploiting the flaw on real-world systems, so organisations should not treat it as a substitute for patching.

The exploit targets CVE-2026-109618, one of two critical PHP2Shell flaws disclosed and patched by the PHP Foundation on Wednesday; the other is CVE-2026-109619. VulnCheck says its technique chains a confirmed memory leak into remote code execution on PHP 8.4.26, with `display_errors=off`; it also works on ARM64, though remote code execution is not yet functional there. The company has seen hundreds of proof-of-concept repositories, but says very few contain working exploits, and warned that attackers are using AI to develop further attacks.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.