No Major PHP2Shell Exploits Seen Yet

Nearly a week after the two PHP2Shell vulnerabilities were disclosed, the large-scale exploitation activity that many researchers feared might follow the publication has yet to materialize. 

There have been reports of isolated exploit attempts, many of which are failing, and plenty of scanning activity from various threat groups. But attackers do not appear to be rushing to target the two PHP vulnerabilities, despite the prevalence of PHP on websites around the world. 

There are likely plenty of factors contributing to the lack of exploit activity, not the least of which is the complexity of the vulnerabilities themselves and the difficulty of developing a working exploit for them. The team at Calif that discovered the two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) developed the initial exploit said the process was quite complex and would take a non-trivial amount of work for an attacker to reproduce. 

That’s proven to be true so far. 

Some teams, including VulnCheck, have developed private, working exploits, and there are many others circulating on GitHub. But researchers say the majority of those don’t work and others are built for one specific PHP version and target system setup. 

Another reason for the relative quiet on the exploit front for PHP2Shell is the existence of literally thousands of other known vulnerabilities in high-value targets such as edge security devices and enterprise apps that are not currently attracting huge amounts of attention from defenders. The pre-disclosure headlines about the PHP2Shell bugs helped galvanize security teams and sput them to deploy the patches once they were released on Oct. 21, and that has patching effort has continued since then. 

Data from internet intelligence firm Censys shows that on the day the patches were released, more than 40 million affected PHP services were online. Since then, more than 10 million of those have been patched. While there’s still plenty of potential targets ot there, that’s a significant reduction in less than a week.

Meanwhile, CISA has added both of the PHP2Shell bugs to its Known Exploited Vulnerabilities catalog.