PHP2Shell exploit bypasses ASLR to achieve RCE on PHP 8.4.26 servers

VulnCheck developed what it calls the first known exploit to achieve remote code execution via the PHP2Shell flaw (CVE-2026-109618) on ASLR-enabled x86-64 systems running PHP 8.4.26 with recommended production settings. The exploit is limited to Initial Access Intelligence customers and does not yet achieve RCE on ARM64.

• Exploit chains a memory leak into RCE on PHP 8.4.26
• Works with ASLR enabled and display_errors=off
• RCE not yet functional on ARM64 systems
• Patches for CVE-2026-109618 and CVE-2026-109619 shipped Wednesday