Researchers defeat ASLR to exploit PHP2Shell flaw on x86-64 servers

Researchers at VulnCheck have developed an exploit that can use the PHP2Shell vulnerability to run code remotely on x86-64 servers despite address space layout randomisation (ASLR) and PHP’s recommended production settings. The finding matters because ASLR had been a major obstacle to exploiting the flaw on real-world systems, so organisations should not treat it as a substitute for patching.

The exploit targets CVE-2026-109618, one of two critical PHP2Shell flaws disclosed and patched by the PHP Foundation on Wednesday; the other is CVE-2026-109619. VulnCheck says its technique chains a confirmed memory leak into remote code execution on PHP 8.4.26, with `display_errors=off`; it also works on ARM64, though remote code execution is not yet functional there. The company has seen hundreds of proof-of-concept repositories, but says very few contain working exploits, and warned that attackers are using AI to develop further attacks.