PHP2Shell Exploits Achieve Real RCE

Researchers operating honeypots (Perplexity's Adel Karimi and others) recorded confirmed remote code execution and memory disclosure against Apache mod_php running PHP 8.4.26, producing an 800 KiB decoded cookie dump and payloads using derived addresses. These in‑the‑wild confirmations came days after patches, showing exploit chains can quickly move from PoC to usable attacks in common hosting profiles. — This signals a short window between patch release and effective exploitation for core web components, raising questions about patch adoption, hosting default configurations, and responsibilities of maintainers and providers.