PHP2Shell: How Hacked PHP Sites Send Phishing That Passes DMARC

The web server is not the prize. The prize is everything the internet already trusts about it.

On October 21, PHP shipped emergency fixes for PHP2Shell, two critical flaws in PHP core. One crafted HTTP request, no login, and an attacker runs code on the server before WordPress, Drupal or Roundcube even load. Most of the coverage so far is about patching web servers. That is the right first move.

But I have spent my career fighting phishing and abuse, first on Safe Browsing and reCAPTCHA at Google and now at AegisAI, and I can tell you where this one ends up. It ends up in your inbox. Here is why, what our data already shows, and what to do about it this week.

Key takeaways

What we found

PHP2Shell is a web vulnerability with an email blast radius. The two flaws sit beneath about 70% of websites with a known server-side language (W3Techs), and nearly half of PHP websites run versions that no longer get security updates.

We connected PHP2Shell to telemetry from our Q3 2026 State of the AI Attack report, drawn from more than 100 million emails across over 1 million protected mailboxes. That data shows AI Dragnet campaigns, the high-volume, single-template class of AI-written phishing, moving from throwaway lookalike domains to compromised, legitimate infrastructure. That shift happened in the quarter before PHP2Shell was disclosed.

Below, I walk through three paths from a PHP2Shell foothold to the inbox: the trusted sender, the trusted link host and the webmail foothold. I show why SPF, DKIM, DMARC and reputation filtering pass all three, and I share detections at the web, mail-server and message level.

Our assessment is simple. PHP2Shell is a supply shock for exactly the infrastructure AI Dragnet operators had already started to buy.

1. Why a PHP vulnerability is an email security problem

The most dangerous email attacks rarely start in email. They start with the infrastructure email trusts.

Attackers do not want a small business's web server for its data. They want its reputation: years of clean domain history, a valid TLS certificate, search ranking, an SPF record that already authorizes the host, and a sending record mailbox providers recognize. Island's analysis of PHP2Shell makes the same point. A compromised site already has that trust, while a newly registered domain has to earn it (Island).

Our Q3 2026 data shows this is no longer a theory. In a single quarter, AI Dragnet went from the phishing class most reliably caught on sender reputation alone to the class least caught that way, because operators moved into compromised, legitimate senders.

We call this trust hijacking. Impersonation pretends to be the trusted sender. Trust hijacking is the trusted sender.

PHP2Shell lands on top of that trend. PHP runs 69.3% of websites with a known server-side language, and about 48% of PHP sites run a version the PHP project no longer supports (Island). Patching and web-layer detection matter, and most coverage rightly focuses there. This post follows the access downstream, into the inbox.

2. PHP2Shell technical breakdown (CVE-2026-109618 and CVE-2026-109619)

PHP2Shell is a pair of memory-safety flaws in PHP's request-startup path. Together they give unauthenticated remote code execution from a single crafted multipart/form-data request. Both are rated CVSS v4.0 9.2.

Root cause

CVE-2026-109618 (out-of-memory corruption). PHP's fatal-error path unwinds with longjmp(). When an out-of-memory condition fires mid-request, request memory is left partially initialized, and cleanup treats invalid data as valid (PHP advisory).

CVE-2026-109619 (stale global state). The same longjmp() unwinding can leave global pointers referencing freed memory, which later requests on the same worker may read or act on (PHP advisory).

How the exploit works

Calif's public chain triggers the out-of-memory condition with hundreds of empty file-upload fields. That exhausts PHP's default 128 MB memory_limit inside a request smaller than PHP's default 8 MB post_max_size (Island, PHP manual). PHP's advisory lists upload-progress tracking as the exposure for CVE-2026-109619, and PHP's interim mitigation for it is session.upload_progress.enabled=0. PHP rates the risk highest for mod_php (PHP advisory).

Here is the part email defenders need to hear. The bug fires during request parsing, before WordPress, Drupal, Magento, Laravel or Roundcube code runs. A fully patched CMS or webmail application on unpatched PHP is still exploitable (Island).

Affected and fixed versions

Exploitation timeline

As of October 21, reliable public exploits were still scarce and most telemetry showed probing rather than confirmed compromise (Tanium). As of October 26, neither CVE is in CISA's Known Exploited Vulnerabilities catalog (CISA). That window is closing.

3. What our Dragnet data shows: AI phishing had already moved onto compromised infrastructure

Our Q3 2026 data shows the cheapest class of AI phishing leaving disposable domains for hijacked, legitimate senders. That is exactly the asset PHP2Shell mass-produces.

To be clear about timing: the window is July 1 to September 2, 2026, before PHP2Shell was disclosed. None of this activity is attributed to PHP2Shell. It is the demand side of the market PHP2Shell now supplies.

AI Dragnet is our category for one AI-written template sent to as many organizations as possible, often within minutes. We classify it by fan-out: the same message or template reused across many organizations. Its share of all confirmed phishing grew 11.6x in one quarter, from 0.5% to 5.8% (see What Is AI Dragnet Phishing?).

The trust-hijacking shift in numbers

AI Dragnet's 7.7% sender-compromise rate is now the highest of the three attack types, ahead of human-written phishing (5.4%) and AI Spearphishing (4.4%). Average evasion across all three types converged on 29%, with a 2.1-point spread, down from 14.7 points in Q2. Roughly three in ten confirmed phishing messages of every type now get past the recipient's email provider entirely.

Fewer lookalikes, more real domains

Self-registered phishing domains leave fingerprints: hyphens, digits, length and stacked subdomains. AI Dragnet's sending domains score cleaner than human-written phishing on every one. That fits a shift to established, compromised domains.

AI Dragnet also runs on a small, stable pool rather than burn-after-use domains. 53.8% of its 926 unique sending domains were seen two or more times, and those repeat domains carried 91.6% of its volume. Its sends spike at Monday 11:00 UTC, with 5.5% of quarterly volume in one hour and the lowest weekend share (7.8%). That is the signature of scripted sending.

Campaigns already using compromised web infrastructure

AEGIS-IS-CAPTCHATHEBILL-005 (WordPress path staging). A fake document-portal notice reached nearly a quarter of protected organizations in 88 minutes. Its first-hop redirector, kompactsystems[.]com, registered in 2005 and fronted by Cloudflare, shows signs of compromise and served the lure from /wp-includes/sitemaps/. A second, purpose-registered first hop (caseforge-law[.]com) copied the same pattern with /wp-includes/theme-compat/. Both chained to a final landing page gated by Cloudflare Turnstile. MITRE maps this to T1584.004, Compromise Infrastructure: Server. It is a comparable path, seen before PHP2Shell existed.

AEGIS-IS-REDTIDE-002 (compromised small-business landing host). A Google Calendar invite worm sent from hijacked Google Workspace accounts reached 73% of tracked organizations and turned a victim into the next sender in under 19 minutes. Among 60+ rotating landing hosts was accounts.tlcproroofings[.]com, a compromised small-business site serving a fake human-verification slider in front of a spoofed Google sign-in.

AEGIS-IS-FAKESERVICE-003 (aged-domain reputation). A ServiceNow invoice wire-fraud persona reached over half of protected organizations. It was DKIM-signed through aged domains such as rbtrees[.]com (registered 2004, reputation 100/100) and linksderisar[.]com (registered 2012, reputation 92/100), and sent via Amazon SES. This is trust hijacking one layer down: borrowed domain reputation instead of a hijacked inbox.

The lures did not change this quarter. Google Workspace was the most impersonated brand in every attack type (33.0% of AI Dragnet volume), and invoice fraud (19.4%) and thread hijacking (17.7%) led AI Dragnet's pretexts. What changed was the account and the infrastructure behind the lure.

4. The PHP2Shell email attack chain: three paths to the inbox

A PHP2Shell foothold gives an attacker three routes into email, and each one borrows trust the attacker did not earn. Public PHP2Shell reporting so far centers on web intrusions. The email paths below are our analysis, grounded in the Q3 campaigns above.

One unpatched PHP server becomes three ways into the inbox

All three paths end the same way: a message that is authentic, reputable and malicious.

Path 1: The trusted sender (authenticated outbound phishing)

The attacker's code runs as the web-server user, which on most PHP hosts already has an approved route to send mail as the domain.

Path 2: The trusted link host (phishing pages and redirectors)

Compromised sites already host phishing pages, fake updates, scam redirects and ClickFix lures. In the Ghost CMS campaign in May 2026, XLab counted more than 700 poisoned sites, and one operator's lists held close to 2,000 hacked domains (Island). Our Q3 campaigns show the pattern PHP2Shell will scale:

A credential page on a decade-old small-business domain with a valid certificate looks nothing like the throwaway .icu domains most URL filters are tuned to catch.

Path 3: The webmail foothold (mailbox access and thread hijacking)

Roundcube, Horde and SquirrelMail are PHP applications, and so are many hosting control panels that manage mailboxes. Because PHP2Shell runs before application code, a fully patched Roundcube on unpatched PHP is exposed. Code execution on a webmail host typically gives the attacker:

Follow-on speed is measured in minutes. REDTIDE turned a credential victim into its next sender in under 19 minutes.

5. Why SPF, DKIM, DMARC and reputation filtering miss PHP2Shell phishing

Every layer of a secure email gateway asks some version of one question: do we trust where this came from? Trust-hijacked mail is built to answer yes, and our Q3 data measures the result.

The content layer is weakening too. In Q3, AI-generated phishing read as more personal and ran longer than human-written phishing, and both gaps widened. The old "short, generic, impersonal" rule of thumb is now backwards. AI Dragnet scored highest of the three types for personal-sounding language, even though by definition it is untargeted. (We covered the DMARC side in depth in Why DMARC-Passing Emails Can Still Be Phishing.)

So here is the common failure. Every check gives a signal, and every signal is green. Stopping these attacks means investigating what the message is actually trying to do: where the link goes after the gate, whether the sending path changed, and whether the request fits the real relationship. That takes evidence, not probability.

6. Detection and threat hunting for PHP2Shell-driven email abuse

Hunt at three layers: the PHP host, the mail path it can reach, and the inbound mail it produces. The examples below are starting points. Tune them to your stack before you alert on them.

Layer 1: Exploitation and post-exploitation on PHP hosts

# New PHP files under the web root since the details leaked (Oct 20, 2026)
find /var/www /home/*/public_html -type f -name '*.php' -newermt '2026-10-20' \
  -not -path '*/cache/*' -printf '%TY-%Tm-%Td %TH:%TM %u %p\n' | sort

# Non-asset content planted under WordPress core paths (CAPTCHATHEBILL pattern)
find /var/www /home/*/public_html -path '*/wp-includes/*' -type f \
  \( -name '*.html' -o -name '*.htm' -o -name 'index.php' \) -newermt '2026-10-20'

Layer 2: Mail sent from the web tier

# Postfix: messages submitted locally by the web-server user (uid 33 = www-data on Debian/Ubuntu)
grep -E 'postfix/pickup\[[0-9]+\]: [A-F0-9]+: uid=33 ' /var/log/mail.log | awk '{print $1, $2, $3}' | uniq -c

# cPanel/Exim: mail generated by scripts in user web roots, ranked by directory
grep -oE 'cwd=/home/[^ ]+/public_html[^ ]*' /var/log/exim_mainlog | sort | uniq -c | sort -rn | head

Layer 3: Inbound mail from someone else's compromised PHP host

This is where most organizations are exposed, because they do not control the sender. These signals survive a clean SPF, DKIM and DMARC result:

No single signal is a verdict. Each one decides the next check. That is why this layer has to be an investigation, not a score.

7. MITRE ATT&CK mapping

8. What security teams should do now

Patching covers your own servers. Your inbox is exposed to everyone else's.

Harden your own PHP estate and sending domains

Defend your inbox against everyone else's compromised servers

Frequently asked questions

PHP2Shell is a supply shock for trust hijacking

PHP2Shell will be remembered as a web vulnerability. Its longest tail will be in email.

Before PHP2Shell was disclosed, the cheapest AI phishing had already learned to send from compromised senders and stage on compromised WordPress sites. Doing that lifted its evasion rate by 8.4 points in one quarter. PHP2Shell now puts a large pool of new trusted domains on the table, about 2.24 million internet-facing hosts advertise PHP, and many of them will not be patched.

This is the class of attack we built AegisAI for. When the domain is real, authentication passes and reputation is clean, a probability score has nothing left to measure. Proteus, the foundation model from the AegisAI Lab trained on email, investigates each message inline before delivery. It follows the link past the gate, checks the sending path against history, and tests the request against the real relationship. On a benchmark of 3,020 unseen attacks, it identified more than 99%, against 81.3% for the leading general-purpose model.

Proof. Not probability.

Want to see how your current stack handles phishing from a compromised but legitimate domain? Talk to the AegisAI team, and we will show you what is in your inbox right now.

References