Executive Summary
In late October 2026, security sensors recorded active exploitation of PHP2Shell, a critical vulnerability affecting the PHP engine. Two distinct source IP clusters (15.204.59[.]70 and 162.35.99[.]94) utilized a sophisticated four-stage multipart HTTP POST chain to achieve Remote Code Execution (RCE) on systems running PHP 8.4.26 under Apache mod_php.
The attack chain involves exhausting PHP memory limits to trigger information disclosure, which then allows the attacker to calculate relative memory offsets and bypass Address Space Layout Randomization (ASLR). Once bypassed, the final stage delivers a payload that spawns a shell directly parented by the Apache worker process. The observed commands were primarily used for discovery and proof-of-concept validation, though the technique supports full system compromise.
This activity demonstrates the maturation of the public PHP2Shell exploit template (e.g., the 9bie PoC), with attackers successfully adjusting payloads to account for randomized memory layouts in real-time. Organizations using PHP, especially in single-worker Apache configurations, should prioritize patching and monitor for the specific multi-stage request fingerprints detailed in this report.