PHP2Shell Flaws Draw Heavy Attention, but Attackers Face Hurdles to Exploit Them

On October 21, 2026, PHP disclosed two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell. Under certain conditions, they could let an unauthenticated attacker run their own code remotely on products using vulnerable PHP versions. PHP powers around 70% of all websites, including WordPress, so the flaws have attracted wide media and industry attention.

CrowdStrike Counter Adversary Operations says the immediate risk may be limited. Many of the proof-of-concept examples it has analysed only crash the software and show a flaw exists. Turning them into a reliable attack is not trivial or guaranteed. Attackers must tailor an exploit to the specific PHP version and application, which means matching the same containers, packages and other components the target uses. CrowdStrike has not seen successful exploitation in the wild or in its honeypot environments, and has found no fully weaponised exploit. It has observed only testing, probing and unsuccessful attempts.

That does not mean businesses can ignore the issue. CrowdStrike notes that attackers have other proven vulnerabilities that deliver unauthenticated remote code execution against many PHP-based applications at scale, so they may favour those for now. Preliminary analysis also suggests many older PHP versions, including end-of-life ones, are affected and may receive only limited patches.