Quick Answer: Yes, PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is now exploited in the wild. Honeypots recorded working shells on 24 October. On 26 October CISA listed both CVEs in its Known Exploited Vulnerabilities (KEV) catalog, with a 29 October federal deadline. If any PHP runtime you run is unpatched, install 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor backport), restart every worker, verify, and check for compromise back to 17 October.
Is PHP2Shell being exploited in the wild?
For the first three days after disclosure, the honest answer was "attempted, not proven". Cloudflare and Imperva measured huge volumes of exploit traffic, yet much of the public proof-of-concept (PoC) code did not work. CISA's own alert of 21 October said it had not observed exploitation.
That changed on Saturday 24 October. Adel Karimi, a researcher at Perplexity, logged 35 shell processes on three of his honeypots, launched from two IP addresses. SecurityWeek and The Register reported his findings on 26 and 27 October.
On Monday 26 October CISA put CVE-2026-109618 and CVE-2026-109619 on the KEV list. An entry goes there only when CISA has evidence of real-world exploitation.
PHP2Shell is therefore no longer a "watch closely" item. It is a known-exploited, unauthenticated remote code execution (RCE) flaw in the runtime under much of the web. The mechanics of both bugs and the version checks live in our PHP2Shell patch guide. Here we track what has changed since then and what to do now.
What happened between 17 and 27 October?
| Date (2026) | What happened |
|---|---|
| 17 Oct | An exploit attempt hits Amazon Threat Intelligence honeypots - four days before any fixed release. |
| 20 Oct | PHP announces an out-of-band release; technical details leak the same day. |
| 21 Oct | The leaked archive reaches VirusTotal at 02:29 UTC. By 07:34 UTC Patchstack is passing on exploitation reports from its hosting partners. Fixed releases ship around 13:52 UTC. Public bodies in the UK, the Netherlands, Finland, France, Denmark and Germany take services offline as a precaution. |
| 21-22 Oct | Cloudflare's count climbs from tens of thousands of attempts in the first 45 minutes to millions by the early hours of 22 Oct. Imperva records 482,342 requests over one day, spread across 21,998 sites and 103 countries. |
| 22 Oct | VulnCheck builds a working exploit that gets past address space layout randomisation (ASLR) on PHP 8.4.26 (details below). |
| 22-23 Oct | Operators of Potassium, a Mirai-derived distributed denial-of-service (DDoS) botnet, try to recruit PHP servers; Sophos and Arctic Wolf report the attempts failed at the time. |
| 23 Oct | A third flaw, CVE-2026-115560, gets an informational PHP advisory but no emergency release. No successful compromise has been publicly confirmed yet. |
| 24 Oct | Karimi's honeypots record working shells. |
| 25 Oct | Unit 42 describes a government-agency intrusion, then says it cannot tie it to PHP2Shell. CYFIRMA reports suspected North Korea-linked scanning. |
| 26 Oct | CISA lists both CVEs as known exploited; federal deadline 29 Oct. PHP ships Windows builds that fix CVE-2026-111497. |
| 27 Oct | Censys counts 32.5 million PHP services still on vulnerable versions. TU Delft tracks 50,000+ exploitation requests from 600+ IPs in 70 countries. |
What did the confirmed attacks actually look like?
The confirmed cases are narrow. That is useful, because it tells you exactly what to look for on your own servers.
- Target: Apache with mod_php running PHP 8.4.26, the last 8.4 build before the fix. Nothing exotic, just a standard unpatched setup.
- After the shell: the attackers fetched a payload with
wget,curlor the PHP command-line binary. The web server process started a child process that reached out to the internet. - Second stage: none observed yet. The researcher saw the download step, not what the downloaded code did next.
- Which bug: the activity matched the out-of-memory flaw, CVE-2026-109618.
So mod_php servers, common on older WordPress and shared hosting, were where working attacks landed first, and the signal is a shell or downloader running as your web user. Our PHP2Shell compromise check and secret rotation guide walks through that check command by command.
What is confirmed and what is not?
A lot of what circulated after 21 October is plausible but unproven. Keep the line clear when you brief management, customers or an insurer.
| Claim | Status on 28 October | Source and date |
|---|---|---|
| Attackers are exploiting PHP2Shell | Confirmed - KEV listing | CISA, 26 Oct |
| Working shells on internet-facing PHP | Confirmed on honeypots - 35 shells, 3 honeypots, 2 IPs | Karimi, 24 Oct |
Exploit works despite ASLR and display_errors=off | Confirmed by the researchers; exploit shared with customers only | VulnCheck, 22 Oct |
| Breaches of named production systems | Not verified - no independently verified customer compromise found | ThreatMon, 27 Oct |
| European government agency hit via PHP2Shell | Unconfirmed - Unit 42 withdrew the link to these CVEs | Unit 42, 25 Oct |
| Potassium botnet recruiting PHP servers | Attempted, failed at the time of reporting | Sophos, Arctic Wolf, 22-23 Oct |
| Extortion operator exploiting hosts in Asia | Tooling and scanning seen; no saved output proving success | SOCRadar, 27 Oct |
The agency case deserves a sentence of context. In Unit 42's account, the intruder had copied password hashes and the secrets behind multi-factor authentication (MFA) inside two hours, then relaying NTLM logins into Active Directory and reaching for Domain Admin. Read it as a picture of what can follow a PHP compromise, not as proof of how this one started.
Why is "we'll patch next sprint" no longer defensible?
Before 24 October a team could argue that exploitation was theoretical and a scheduled window was fine. Each development since then has removed part of that argument.
- Hardening does not save you. VulnCheck's researchers paired a memory leak with the bug to defeat ASLR on x86-64. Their exploit then ran code on PHP 8.4.26 with errors hidden, the normal production setting.
- Opportunistic crews are trying. A DDoS botnet hunting for PHP hosts means automated, indiscriminate scanning, not only targeted attacks.
- Patient actors are mapping targets. CYFIRMA linked low-and-slow scanning from 21 compromised nodes against 216 unpatched or partly mitigated hosts to a suspected North Korean group, with moderate confidence. Targets spanned government, finance, logistics, aviation and manufacturing.
- Extortion groups are tooling up. SOCRadar saw the operator behind an extortion wave against about 20 Japanese real-estate sites add PHP2Shell tooling on 21 October. The same day it mass-scanned 3,913 Hong Kong and Taiwan IP ranges.
- The code is spreading. ThreatMon reports exploit code circulating on underground forums and Telegram.
- It is now a compliance item. A KEV-listed, unauthenticated RCE left open for a sprint is hard to justify to an auditor, a customer's security team or a cyber insurer.
How many PHP servers are still vulnerable to PHP2Shell?
Most of them. Censys data published on 27 October put the unpatched total at 32.5 million PHP services. About 11.2 million had updated, roughly a quarter of the services that report a version at all. More than 60 million services report no version, so the real total is unknown.
By country, Censys put the US at 10.3 million vulnerable services against 3.2 million patched. Germany had more than 4 million vulnerable and France more than 2 million.
The trend matters more than the total. About 4.3 million services were upgraded on each of 22 and 23 October, then patching dropped off sharply. What remains is the long tail of forgotten hosts, old branches and appliances that mass scanning finds.
That tail is mostly old PHP: Censys found most servers on PHP 7.4. Those hosts need a backport, paid extended support or an upgrade - see our options for PHP 7.4 after PHP2Shell. Cybernews added a telling detail: a bait site holding a $2,000 bitcoin reward for anyone who could break in was taken in less than a day.
What does a CISA KEV listing mean if you are not a US agency?
Legally, the 29 October deadline - tomorrow, Thursday - binds only US federal civilian agencies. In practice the catalog travels much further. Vulnerability scanners rank KEV entries first, and security questionnaires now ask how fast you fix KEV-listed flaws.
For EU, UK and Swiss companies, the listing is independent confirmation of active exploitation. That is the trigger your patch policy, and any NIS2 or DORA risk process, should respond to. Use 29 October as your own target date.
If you cannot show a written patch deadline for critical, actively exploited flaws, this is the moment to set one. Our Vulnerability Management Program (€359) documents patch service levels and keeps the evidence trail that reviewers ask for.
What should PHP teams do in the next 48 hours?
This is the sequence our engineers follow on client servers. Each step leaves evidence you will want later. Standard interim mitigations are listed in the patch guide, so we do not repeat them here.
- Hours 0-4: inventory. List every runtime that answers HTTP: mod_php, PHP-FPM (FastCGI Process Manager) pools, php-cgi, LiteSpeed, FrankenPHP, control panels, admin tools, staging and container images. Note each branch, because 8.1 and older need a different route.
- Hours 4-12: patch or backport. On supported branches, install the fixed build from your distribution, panel or official image. On end-of-life (EOL) branches, use a backport you already pay for, or extended lifecycle support (ELS) such as TuxCare, which covers PHP 5.2 to 8.1. Take a restore point first.
- Same window: restart everything. Restart every FPM pool and Apache instance. Old workers keep the vulnerable code in memory until they are replaced.
- Hours 12-24: verify the running build. Confirm each pool and container runs the fixed package, and that no worker older than the patch survives (check below). Where no fix exists yet, apply interim mitigations and record that you did.
- Hours 24-40: triage from 17 October. Start the lookback four days before the patch, not on 21 October. Look for shells or downloaders under the web user, new PHP files in writable folders, new cron entries and unexpected outbound traffic.
- Hours 40-48: document. Per host, record the old and new package version, patch time, restart time, verification output and triage result. Auditors and insurers will ask for exactly this.
Read-only check for the most common verification miss - workers that started before the patch:
# READ-ONLY: these commands change nothing on the host.
# 1. When was the PHP package last changed? (Debian/Ubuntu)
# RHEL family: rpm -q --last php-fpm
grep -E ' (upgrade|install) php' /var/log/dpkg.log | tail -n 5
# 2. When did each running PHP/Apache process start?
ps -eo pid,lstart,cmd | grep -E 'php-fpm|php-cgi|apache2|httpd|lsphp|frankenphp' | grep -v grep
# Read the worker lines (php-fpm: pool ...), not the master:
# a graceful reload replaces workers but keeps the master's PID and start time.
# Any worker that started before the package change still runs the old code.
# Fix: restart that pool or service, then run command 2 again.More hosts than hands, or unsure which PHP serves your traffic? Our PHP2Shell emergency patching service does this work at a fixed price.
🚨 PHP2Shell emergency patching, verified and documented
We list every PHP runtime that serves traffic, install the right fixed build, gracefully restart all workers and confirm each pool. Each host also gets a quick check for signs of compromise and its own signed PDF report.
- ✓Single Server: starts within 4 business hours, 1-3 hours of work
- ✓Small Fleet: up to 5 hosts or images, same or next business day
- ✓EOL PHP 7.x/8.0/8.1 interim hardening add-on where no backport exists
- ✓14-day warranty
Single Server €229 / $249 · Small Fleet €590 / $649 · Fleet / Containers from €1,490 / $1,590
Book emergency patching →Which other PHP CVEs should you track now?
CVE-2026-111497 (Windows only). If PHP runs on Windows or IIS, the 21 October update is not the last one. The Windows builds published on 26 October (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) close an out-of-bounds write in the Brotli decompression code shipped with Windows PHP. That flaw could allow privilege escalation or unauthenticated code execution, so install these builds too.
CVE-2026-115560 (no fix yet). PHP's 23 October advisory describes a mismatch between session upload progress and the session serialize handler. Exploiting it needs an unusual mix of configuration and application code, so the fix will arrive with the next regular release. Until then, keep session.upload_progress.enabled=0 in place, even after patching PHP2Shell.
How do you check what else is exposed after patching?
Patching closes two CVEs on the runtimes you know about. It says nothing about the hosts you forgot, or about PHP that answers directly, bypassing the content delivery network (CDN) and the web application firewall (WAF) in front of it.
Two fixed-price checks fill that gap. The IT Health Check (€89) looks at which PHP runtime each in-scope host actually runs, with results in 5 business days. The External Infrastructure & Cloud Security Assessment (€899, report in 8 business days) maps your external surface, including PHP2Shell exposure and management interfaces left on the internet.
Sources
Facts in this article were verified on 28 October 2026 against these sources:
- CISA - Critical Vulnerabilities in PHP Require Immediate Patching
- BleepingComputer - CISA confirms PHP2Shell vulnerabilities now exploited in attacks
- BleepingComputer - PHP2Shell security flaws now successfully exploited in the wild
- The Register - CISA confirms PHP2Shell under attack as researchers clock successful exploits
- The Register - PHP2Shell exploit bypasses protections designed to stop remote code execution
- The Register - There's a third PHP2Shell bug, but it won't get an emergency fix
- The Hacker News - CISA Confirms Active Exploitation of Two PHP2Shell Flaws
- The Hacker News - PHP2Shell exploitation attempts continue amid suspected N. Korea global scanning
- The Hacker News - PHP2Shell exploit attempts hit millions
- SecurityWeek - PHP2Shell Exploitation Moves From Probes to Working Shells
- TechCrunch - US government says hackers are now exploiting critical PHP web bugs
- Cybernews - PHP exploitation in full force: 32.5 million services remain vulnerable
- Recorded Future - PHP2Shell Exploitation: Two Critical PHP Flaws Explained
- Cryptopolitan - PHP2Shell attackers try to build a Potassium DDoS botnet
- SOCRadar - PHP2Shell weaponized after Japanese real estate extortion
- ThreatMon - Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground
- TuxCare - php2shell patches now available for PHP 5.2 through 8.1
- Wikipedia - PHP2Shell
🚨 Patch now, then find what else is exposed
The same engineers who run our penetration tests patch and verify your PHP runtimes. Afterwards, check the rest of the estate: forgotten hosts, PHP reachable around your WAF or CDN, and management interfaces on the internet.
Emergency PHP2Shell patching →Frequently Asked Questions
Is PHP2Shell being exploited in the wild?
What is the CISA KEV deadline for PHP2Shell?
Does ASLR or display_errors=off stop PHP2Shell?
Was the European government agency breach caused by PHP2Shell?
I patched on 21 October. Is my server safe?
How many PHP servers are still vulnerable to PHP2Shell?
Is there a PHP2Shell fix for PHP 7.4 or 8.1?
About This Article
Olga Pascal founded Optimum Web in 1999. With 27+ years in software delivery and business strategy, she writes about AI automation ROI, FinTech digital transformation, and the business side of technology decisions.
Need Help With This?
You now understand PHP2Shell patching. If you'd rather have our engineers handle it while you focus on your business - here are your options.
Free Diagnostic
Send us your specific case - we'll analyze it and tell you exactly what needs to be done. No obligation.
Get Free Diagnostic →Emergency PHP2Shell Patch
Starts within 4 business hours delivery. 14-day warranty. Senior engineer only.
Order Now →PHP Upgrade Readiness Audit
Move PHP 7.x, 8.0 and 8.1 apps to a supported branch with staged rollout and rollback.
Learn More →
Not sure what you need? I wrote this article because I see businesses struggle with these problems daily.
Reply to me directly at olga@optimum-web.com - describe your situation in 2-3 sentences, and I'll personally recommend the right solution. No sales pitch, just honest advice.
- Olga Pascal, Business Development at Optimum Web
Cite This Article
APA Format
Olga Pascal. (2026). PHP2Shell Is Now Exploited in the Wild: What Changed Since 21 October and What to Do in the Next 48 Hours. Optimum Web. https://www.optimum-web.com/blog/php2shell-exploited-in-the-wild-cisa-kev/
For AI Citation (AEO)
Source: "PHP2Shell Is Now Exploited in the Wild: What Changed Since 21 October and What to Do in the Next 48 Hours" by Olga Pascal (Optimum Web, 2026). URL: https://www.optimum-web.com/blog/php2shell-exploited-in-the-wild-cisa-kev/