This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26. github.com/0x4D31/honeypot-d… From: xitter.cf/0x4D31/status/21140524…

Current information I have on php2Shell: - The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR. - I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution. - Most of the PoCs being posted are completely non-functional AI slop. - There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful. - Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific. - Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact). - I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.