“We haven't identified another public or commercial exploit that achieves this under the same conditions. Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome.”

Spencer McIntyre · said date not stated · reported 2026-10-23

Spencer McIntyre stated VulnCheck's exploit is unique in achieving RCE under PHP's recommended production conditions.