UK Government Sites Downtime Follows PHP2Shell RCE Exploit

A sophisticated exploit targeting PHP’s PHP2Shell vulnerability has bypassed standard memory protections, enabling remote code execution on production servers. According to The Register, this technical advance coincided with widespread downtime for UK government websites, which proactively went dark to mitigate the risk.

How the exploit bypasses memory protections

Address Space Layout Randomization (ASLR) typically prevents attackers from guessing the memory addresses needed to execute malicious code by scrambling these locations during runtime. VulnCheck researchers developed a technique that circumvents this defense on x86-64 systems running PHP with recommended production configurations. Spencer McIntyre, director of exploit development at VulnCheck, described the achievement as a significant advance because ASLR had previously been a major barrier to real-world exploitation.

The scope of the PHP2Shell vulnerabilities

The exploit targets CVE-2026-109618, a critical out-of-memory corruption bug that allows remote code execution. This flaw is part of the PHP2Shell pair, alongside CVE-2026-109619. The PHP Foundation officially disclosed both vulnerabilities and issued corresponding patches on Wednesday, according to The Register. Despite the availability of fixes, the window for exploitation remains a concern for organizations that have not yet applied the updates.

Why this exploit matters more than previous proofs

VulnCheck observed hundreds of PHP2Shell proof-of-concept repositories on GitHub, but noted that very few contained legitimate, working exploits. McIntyre explained that demonstrating a vulnerability is distinct from developing an exploit that overcomes real-world security protections. The new technique represents the first known instance of achieving remote code execution on ASLR-enabled systems, signaling that adversaries are investing significant resources into overcoming these defenses.

The role of AI in threat development

Researchers warned that threat actors are leveraging artificial intelligence to identify additional attack vectors for the PHP2Shell flaws. McIntyre stated that adversaries are clearly spending time and tokens on this specific bug, suggesting that the initial exploit may be just one of many emerging techniques. VulnCheck made the new exploit available exclusively to its Initial Access Intelligence customers, highlighting the advanced nature of the threat.

What analysts watch for

Teams usually monitor for unusual memory access patterns that indicate attempts to bypass address randomization. Analysts should examine server logs for unexpected remote code execution indicators, such as unauthorized process spawning or anomalous network connections originating from web servers. Persistence mechanisms often involve writing new scripts or modifying configuration files, so integrity monitoring is essential. Investigators also look for signs of lateral movement following initial compromise.

Background: Attack vectors

Attack vectors are the specific paths adversaries use to infiltrate systems. Common examples include phishing emails, unpatched software vulnerabilities, and weak authentication mechanisms. Understanding these paths allows you to harden interfaces, verify inputs, and restrict permissions before an exploit succeeds.

Read the full guide: Attack vectors examples: how adversaries breach defenses

What to do and how to stay safe: PHP

• Verify that all PHP installations are updated with the patches for CVE-2026-109618 and CVE-2026-109619.
• Monitor web server logs for signs of exploitation attempts, particularly unusual memory-related errors or unauthorized commands.
• Ensure that Address Space Layout Randomization is enabled on all x86-64 servers running PHP.
• Review access controls to limit the impact of any potential remote code execution.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PHP2Shell?

PHP2Shell refers to a pair of critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution in PHP.

Does the exploit work on all systems?

The VulnCheck exploit specifically targets x86-64 systems with ASLR enabled and PHP configured for production use.

Are patches available for these vulnerabilities?

Yes, the PHP Foundation issued patches for both CVE-2026-109618 and CVE-2026-109619 on Wednesday.