PHP2Shell exploitation observed: packet-to-process RCE evidence
Comments on “PHP2Shell exploitation observed: packet-to-process RCE evidence”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A honeypot operator published packet and Tetragon evidence of PHP2Shell remote code execution on 24 October. Across three PHP 8.4.26 targets, 35 execution-stage POSTs matched 35 Apache-parent /bin/sh starts, from two source IPs that the report does not attribute to separate actors. The four-stage chain resembles a public HTTP-only PoC and used leaked memory addresses to adjust the final request. The setup was a favorable single-worker mod_php configuration, so it says nothing about reliability elsewhere. The report's figures are self-reported and unchecked independently.
Why it ranked
No. 1 of 93 with a score of 0.73. The panel rated it highest on technical depth (0.96) and substantiated (0.93), lowest on audience breadth (0.63).
Every answer behind this is in the table under Score.
Score
0.73total under rubric v2.2
- Significance0.67
- Reader interest0.82
- Audience breadth0.63
- Practical relevance0.71
- Substantiated0.93
- Technical depth0.96
- New information0.91
- Counts against: Promotional0.03
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.57 | 0.62 | 0.82 | 0.67 | 0.24 | +0.24 | +0.161 |
| Reader interest | 0.64 | 0.85 | 0.97 | 0.82 | 0.33 | +0.26 | +0.213 |
| Audience breadth | 0.49 | 0.72 | 0.67 | 0.63 | 0.23 | +0.13 | +0.082 |
| Practical relevance | 0.61 | 0.66 | 0.86 | 0.71 | 0.25 | +0.22 | +0.156 |
| Substantiated | 0.98 | 0.84 | 0.97 | 0.93 | 0.14 | +0.05 | +0.047 |
| Technical depth | 1.00 | 0.90 | 0.99 | 0.96 | 0.10 | +0.05 | +0.048 |
| New information | 0.95 | 0.80 | 0.98 | 0.91 | 0.18 | +0.05 | +0.046 |
| Promotional | 0.04 | 0.03 | 0.01 | 0.03 | 0.03 | −0.19 | −0.005 |
| Overclaim | 0.18 | 0.20 | 0.04 | 0.14 | 0.16 | −0.11 | −0.015 |
| Sum of contributions | +0.732 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.732 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-25/1/"><img src="https://rubric.hrih.si/badge/2026-10-25/1.svg" alt="Ranked #1 on Rubric, 25 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 5 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Target-side packet captures and Tetragon process events correlate 35 complete execution-stage HTTP POSTs with 35 /bin/sh starts directly parented by Apache workers (uid=33) across three PHP targets.
The article gives no link or citation for it.
The article says “correlate 35 complete execution-stage HTTP POSTs with 35 /bin/sh starts directly parented by Apache workers (uid=33) across three PHP targets”
The source says No source to compare with.
No source givenNumber
Apache recorded 52 disclosure-sized cookies, each decoding to 819,200 bytes, and 51 complete responses were matched in target-side packet captures with client ACKs.
The article gives no link or citation for it.
The article says “Matching the cookie's SHA-256 from Apache to target-side PCAPs gave 51 complete responses with zero captured response gaps and a client ACK through the response end”
The source says No source to compare with.
No source givenVersion
The reviewed targets ran PHP 8.4.26 under single-worker Apache mod_php with a 128 MiB PHP memory limit.
The article gives no link or citation for it.
The article says “The reviewed targets ran PHP 8.4.26 under single-worker Apache mod_php with a 128 MiB PHP memory limit”
The source says No source to compare with.
Couldn’t checkCausal conclusion
The B2 execution-stage body varied with the target's leaked address range, which supports the published leak-guided ASLR technique rather than a new primitive.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The B2 body varied with the target's leaked address range and the shell command, supporting the published leak-guided ASLR technique rather than a new primitive”
The source says No passage could be compared.
Source cited by the article: github.com/9bie/php2shell-bypass-aslr-exp/blob/d6f888ebd3f0e188bb662e16f23747afdf35e42f/exploit.py
No source givenVersion
The observed exploit chain is consistent with CVE-2026-109618, and the records do not establish use of a distinct CVE-2026-109619 path.
The article gives no link or citation for it.
The article says “The observed chain is consistent with CVE-2026-109618; these records do not establish use of a distinct CVE-2026-109619 path”
The source says No source to compare with.
Couldn’t checkNumber
The B1 body digest also appears in an earlier attempt-only capture report, where identical B1 bodies preceded worker crashes without confirmed RCE.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The B1 digest also appears in the initial attempt-only capture report, where identical B1 bodies preceded worker crashes without confirmed RCE”
The source says No passage could be compared.
Source cited by the article: github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-22-to-24-initial-attempts.md
Couldn’t checkNumber
The public exploit.py revision examined on 24 October filters disclosed pointers below 0x7f0000000000, and the early successful chains had no pointer-like words above that threshold, so an unchanged run would not parse those leaks.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “filters disclosed pointers below 0x7f0000000000. The early successful chains had no pointer-like words above that threshold in their observed cookies”
The source says No passage could be compared.
Source cited by the article: github.com/9bie/php2shell-bypass-aslr-exp/blob/d6f888ebd3f0e188bb662e16f23747afdf35e42f/exploit.py
No source givenNumber
Tetragon recorded 32 Apache-parent shell starts from 162.35.99.94 through 18:57: 19 on T2, ten on T3, and three on T1.
The article gives no link or citation for it.
The article says “Tetragon recorded 32 Apache-parent shell starts through 18:57: 19 on T2, ten on T3, and three on T1”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 25 Oct 2026, 05:46 UTC. It played no part in the ranking.