Adel Karimi, detection and response lead at Perplexity, recorded remote code execution against a honeypot running Apache mod_php with unpatched PHP 8.4.26. The observed chain returned an approximately 800 KiB decoded cookie dump; a function address derived from that dump then appeared in a later execution payload. Expel researcher Marcus Hutchins described the evidence as the strongest confirmation he had seen.
PHP shipped security fixes on October 21. Earlier observed activity had included scanning, fingerprinting, and non-working exploits. The report says the confirmed chain ran on an intentionally favorable single-worker mod_php profile. It does not establish exploit reliability across other worker counts, PHP builds, configurations, or applications, and it does not establish the number of compromised systems. At the time reported, CISA had not listed the flaws as known exploited vulnerabilities.