Unit 42 retracts PHP2Shell government breach link; patch advice stands

Palo Alto Networks’ Unit 42 retracted its link between a European government breach and PHP2Shell on October 25. The report had discussed agentic AI post-exploitation activity; the team could not confirm those vulnerabilities as the initial entry point.

The correction narrows the incident evidence available to server operators. PHP’s developers still identify all installations serving web requests as at risk. They place Apache mod_php at the highest risk, with an attack demonstrated before application code runs. Their security-update recommendation remains in place.

Unit 42 added the AI activity and hunting queries on October 23, then retracted that update on October 25. The current brief rates the two vulnerabilities at a critical 9.2 under CVSS 4.0.

Code execution observed in honeypots

Separate evidence documents successful exploitation. Researcher Adel Karimi’s October 24 report correlates 35 shell starts across three decoy servers running PHP 8.4.26 under single-worker Apache mod_php. These were controlled honeypots built to observe incoming activity.

Karimi matched incoming packets with process launches and error records using time, worker identity and request sequence. Two source-address clusters produced the confirmed events; that count does not identify the number of operators. The report ties the observed chain to CVE-2026-109618. Its 35-shell count describes this monitored environment.

Earlier, on October 23, CrowdStrike said its own observations and honeypots had captured probing and unsuccessful attempts. Many public proofs of concept showed crashes. Turning those into reliable code execution required adaptation to a target’s PHP version and application, the company said. Its observation period preceded Karimi’s October 24 evidence.

Upwind’s October 26 laboratory analysis examined an early circulating public tool. Repeated runs against default PHP-FPM produced neither crashes nor code execution. The researchers said the tool’s recognizable request patterns identify probing, while subsequent behavior establishes the outcome.

Upwind also checked claimed patch bypasses, finding cases dependent on separate application weaknesses or producing only crashes. It reproduced an XML memory-management regression introduced by another change bundled with the security release, and classified that separately from a PHP2Shell bypass.

The PHP Foundation’s October 21 account traces the first signs of the out-of-memory problem to a developer following up a 2024 external audit. Calif’s August report and further analysis from OpenAI and Wiz clarified its impact. The foundation acknowledged delays while developers weighed compatibility, performance and extension support.

The foundation says AI helps validate reports and group submissions sharing a root cause. Its tooling expanded from Claude Mythos scanning to OpenAI Daybreak Red and reproduction environments. People make the decisions and work on every patch. That account describes defensive research, rather than identifying a particular intruder’s tools.

PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. Distributions and long-term-support vendors received patches in advance. The project also provided minimal source backports for some unsupported branches; availability depends on the vendor and support arrangement.

An October 23 notice covers another execution path involving an unusual combination of session configuration and application code. PHP tracks it as CVE-2026-115560 and plans a full advisory with the next regular bugfix release.