Active exploitation proof reported

An active exploitation proof of the PHP2Shell vulnerability has emerged, though it does not appear to be generic. While multiple entities have claimed to have developed proof-of-concept (PoC) exploits, there is still no public evidence of a fully generic exploit that would work across all PHP versions and configurations.

Chronology compiled with AI

An engineer from HubSpot compiled a chronology of the events surrounding PHP2Shell using AI assistance, though it was not fully verified. The summary outlines the sequence of announcements, retractions, and the timeline of vulnerability disclosures and related claims.

Chainguard's early patch release

Before the official release of patches, Chainguard broke an embargo by publishing updated versions of its Wolfi distro 12 hours before the agreed deadline. The company cited reports of active exploitation on coordination channels and the relative ease of creating a PoC as reasons for the early release.

VulnCheck's expanding PoC range

VulnCheck, a cybersecurity firm, initially claimed a PoC that worked against PHP 8.4.26 (mod_php) on x86-64 systems with ASLR enabled and display_errors turned off. Since then, the PoC has been reported to work on most unpatched versions across the PHP 8.2 to 8.5 branches, including the ARM architecture.

Trail of Bits' production exploit

Trail of Bits gradually refined its PoC until it claimed to have a "production" exploit that worked with the default php.ini configuration in multiworker setups. The company demonstrated the exploit against several popular PHP-based applications, including MediaWiki, WordPress, and Laravel.

Indian CERT reports large-scale exploitation

The Indian CERT issued an alert stating that "several reports confirm large-scale exploitation" of PHP2Shell. However, the alert does not provide specific sources or evidence to back up this claim.

Sophos and Palo Alto retract claims

Sophos initially reported proof of compromise related to PHP2Shell but later retracted the claim. Similarly, Palo Alto Networks' Unit 42 team had reported an attack on a European government agency, but they later retracted the claim, noting that the attack may not have been initiated by PHP2Shell.

Perplexity's honeypot observation

The most credible evidence of PHP2Shell exploitation outside of a lab setting comes from Perplexity’s director of detection and response. They observed a four-stage exploitation chain on a honeypot network, which resulted in arbitrary code execution and replicated a public PoC.

Exploitation chain details

The exploitation chain involved four stages. The first request exhausted memory and left the heap in an invalid state. The second forced the return of a large cookie, exposing memory layout. The third stabilized the heap, and the fourth dynamically executed a payload with recalculated memory addresses, bypassing ASLR protections.

Honeypot configuration notes

The honeypot configuration used by Perplexity was not typical, as noted by the company. It involved PHP 8.24.6 instances running via mod_php in monoworker mode with a memory limit of 128MB, which may have made the system more vulnerable than standard setups.

CISA adds PHP2Shell to KEV catalog

On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added PHP2Shell to its Known Exploited Vulnerabilities (KEV) catalog, indicating that the vulnerability is actively being exploited in the wild.