PHP2Shell RCE Confirmed via 35 Shells in Honeypots Using Four-Stage Memory Leak Chain

Adel Karimi's single-worker mod_php honeypots logged a four-stage HTTP sequence on October 24 that triggered memory exhaustion, content leaks for ASLR bypass, and direct shell command execution. One IP address alone produced 32 shells. Activity matched public PoCs for the October 21-patched flaws, with 30 prior OOM errors and 11 crashes observed but no prior code execution. No second-stage downloads occurred. CISA's October 23 alert added Sigma rules yet stated no confirmed exploitation and has not listed the CVEs in KEV as of October 26. Karimi explicitly limited claims to the favorable single-worker profile, noting unreliability on multi-worker or production builds. This telemetry directly contradicts official non-confirmation while aligning with patterns of supply-chain exposure in PHP-driven e-commerce platforms targeted by Mirai operators and other botnet actors. The shift from scanning to working shells post-leak indicates rapid weaponization of memory-disclosure primitives. Expect sustained campaigns against unpatched or misconfigured web hosts until multi-worker mitigations and patch adoption reduce the attack surface. Procurement and incident data from similar PHP flaws show weeks-long lag between honeypot confirmation and broad defender response.