PHP2Shell Attacks Surge, but Experts Say Working Exploits Remain Out of Reach for Now

Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell, have dominated headlines this week. Several large companies report a sharp rise in attempted exploitation. Amazon said it saw attempts dating back to October 17, days before the flaws became public. Arctic Wolf linked attempts it saw to the Potassium botnet, while Cobalt tied attempts to a Mirai botnet. Other experts said attackers were trying to infect devices with malware and turn them into bots for DDoS attacks.

Despite the activity, dozens of experts told Recorded Future News that none of the attempts have succeeded. Sophos reported successful exploitation and then retracted it, saying it had only seen a small number of failed attempts. VulnCheck's Spencer McIntyre said many public proof-of-concept exploits are "garbage and nonfunctional" and only work in developer or researcher environments. Incident responders said attackers are being blocked by address space layout randomization (ASLR), a protection designed to make memory corruption bugs harder to exploit.

The risk is not zero. Google's John Hultquist said exploitation may have begun in a limited way and the threat is "viable and very serious." McIntyre said his team developed a novel ASLR bypass, but they have not found another public or commercial exploit that does the same. As of Friday, mass exploitation looked unlikely.