Cato CTRL Threat Intel: PHP2Shell in the Underground and the Search for a Working Exploit

Executive summary

On October 21, 2026, we observed participants in underground forums seeking PHP2Shell exploits, while others shared scripts presented as exploiting CVE-2026-109618 and CVE-2026-109619. Discussion included doubts about prerequisites and whether circulating code worked. This post examines that gap between interest, claimed capability, and verified exploitation.

Our assessment covers selected forum posts and messages collected as of October 21. The findings show what was being discussed and shared, rather than confirmed compromises.

Forum participants requested exploit material, shared code, and questioned each other’s claims. For the security industry, this is a reminder to share threat findings promptly across security teams, researchers, and vendors so defenders can assess emerging threats and coordinate their response.

Looking for an exploit they could trust

Exploit.in is a long-running, primarily Russian-language underground forum where participants discuss hacking techniques and trade tools and services. Monitoring these discussions can reveal interest in emerging vulnerabilities and questions about available exploits.

“Does anyone have it?” was the question, translated from Russian, in a discussion on Exploit.in naming both PHP2Shell CVEs. The request sought exploit material, while subsequent comments questioned the prerequisites and legitimacy of circulating PoCs. One participant wrote “Didn’t test but seems legit.” A further comment described code execution “with preconditions,” while referring to a different “real exploit.” These are participant opinions about the circulating material, not our technical conclusions.

The exchange in Figure 1 captures both demand for an exploit and doubts about whether the available code worked. It leaves open whether the requester ever obtained a working exploit.

Figure 1. PHP2Shell exploit requests and discussion observed on October 21, 2026.

What circulated on October 21

On October 21, we recorded an English-language technical writeup at 02.23 UTC whose author claimed a lab reproduction. Hebrew- and Persian-language messages recorded at 05.16 and 05.35 UTC shared security alerts about the vulnerabilities and upcoming patches. The language of a post does not tell us where its author is based. At 06.22 UTC, we recorded a separate Exploit.in post presenting scripts as exploits for both CVEs, shown in Figure 2.

Figure 2. Forum post presenting purported PHP2Shell exploits, observed on October 21, 2026.

We redacted exploit instructions and memory offsets to avoid sharing details that could help reproduce an attack. The screenshot preserves the forum context.

A separate screenshot shared in a monitored channel appeared to show command execution on a local test system. We have not independently verified the result, and its exact posting date was unavailable.

By October 21, our searches returned 68 forum posts for PHP2Shell / CVE-2026-109618 and 62 for CVE-2026-109618. Chat searches returned 81 messages for PHP2Shell and 57 for CVE-2026-109619. These figures measure discussion volume in the collected material. The searches overlap, so the counts are not a combined total.

The forum exchanges show participants openly requesting exploit material, sharing code, and questioning each other’s claims. Separately, security alerts circulated in several languages across monitored messaging channels. Together, these observations illustrate how quickly information about a vulnerability can spread. For defenders, they reinforce the value of timely information sharing across organizations and language barriers, with clear distinctions between observed activity, unverified claims, and validated findings.

Public analysis offers context on PoC reliability

Public technical discussion published on October 23 on the SANS Internet Storm Center website examined why some circulating PoCs depended on specific server settings and knowledge of the target environment. The discussion concerned the PoCs reviewed there, rather than every possible way to exploit PHP2Shell.

The public analysis suggests that the PHP version, server setup, and information available to an attacker can affect whether a PoC works. These dependencies may help explain the questions raised in the forum thread.

Connecting intelligence with observed attempts

In our separate traffic analysis, we observed exploitation attempts, scanning, and invalid-PoC attempts. The invalid-PoC attempts add context to the forum discussion about whether circulating code worked. We detail these findings in our published PHP2Shell exploitation and IPS research. We have found no evidence connecting those requests to the forum participants or scripts discussed here.

We continue to monitor PHP2Shell activity and update our protections as exploitation techniques evolve. Our cloud-delivered IPS signatures blocked exploitation attempts on inspected customer traffic without requiring a separate protection package. PHP services outside our inspection coverage require separate remediation and protection. Updating affected PHP installations remains essential.