PHP2Shell: Exploitation Attempts and Remediation Trends

Since the public disclosure of two critical PHP vulnerabilities on October 21, 2026, exploitation attempts leveraging the PHP2Shell mechanism have been monitored. Although no successful full exploit chains have been observed, private exploits exist and some tools attempt to exploit these vulnerabilities. Challenges such as request-size limits, memory exhaustion, and PHP configuration differences have hindered successful exploitation. Some tools labeled as PHP2Shell exploits actually use unrelated session poisoning techniques requiring separate vulnerabilities. Telemetry indicates a significant reduction in exposed vulnerable machines and affected organizations within one week. Despite limited success so far, PHP2Shell remains a significant security risk requiring immediate attention.

• PHP · PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational InfrastructureExploitedVulnerability2026-10-27
• Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructureCampaign2026-10-24
• PHP · PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619ExploitedVulnerability2026-10-21
• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPotCampaign2026-10-22
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21