PHP2Shell: Exposure Falls Sharply, but Exploitation Attempts Have Begun

Wiz Research has published an update on two major PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), known collectively as PHP2Shell. Since the public disclosure on October 21, 2026, the team has seen a limited number of exploitation attempts. It has not found a public proof of concept that shows complete, general exploitation against any target. However, some partners have privately shared working exploits with Wiz, and the team continues its own testing.

The remediation picture is encouraging. Wiz telemetry shows an approximate 67% drop in the daily number of distinct internet-exposed machines vulnerable to PHP2Shell. The share of vulnerable machines running PHP 7.3 or earlier, which did not receive official backports, fell from 8.3% to 5.7% over five days. The number of significantly affected organizations, meaning those with at least one exposed and vulnerable instance, fell by about 47.9%. PHP is used by 65% of organizations in Wiz's dataset.

Wiz says these trends are consistent with organizations patching, upgrading, retiring affected machines and restricting internet access. The data does not show how much each approach contributed, and scan coverage can influence the numbers. Among the activity seen so far are attempts using the PHP2Shell exploit mechanism, with techniques matching those of public proofs of concept. Wiz says it will keep monitoring and update its post as new evidence emerges. This summary covers only the opening of the report.