PHP2Shell Week Two: CISA Confirms Exploitation, a Public Exploit Is Out, and Early Malware Claims Are Walked Back

A week after PHP shipped emergency fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the picture is clearer. The US government now officially says the flaws are being exploited, researchers have caught attackers getting working shells, and exploit code is public. At the same time, two of the most alarming early reports have been corrected. If you read our previous update, this is what has changed.

The short answer: exploitation is now officially confirmed and a public exploit exists. If any web-facing server still runs PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, patch it today or take it offline. Then keep session upload progress disabled and check your logs back to 17 October.

What's new since 26 October

1. CISA confirms active exploitation

On 26 October, the US Cybersecurity and Infrastructure Security Agency (CISA) added both PHP2Shell CVEs to its Known Exploited Vulnerabilities (KEV) catalog. US federal civilian agencies must fix them by 29 October 2026, just three days later. The deadline only binds federal agencies, but CISA urges every organisation to prioritise the fix. A week earlier, CISA had said it had not yet seen successful exploitation.

CISA has not named any victims or said how many production systems were breached. A KEV listing confirms that exploitation is happening, not how widespread it is.

2. Researchers record successful shells

Researcher Adel Karimi recorded 35 successful shell executions across three honeypots (decoy servers) running PHP 8.4.26 on Apache with mod_php. The attacks came from two IP addresses and combined memory exhaustion with information disclosure, consistent with CVE-2026-109618. The attackers then tried to download more tools with PHP, curl and wget, but no extra malware was successfully fetched.

Karimi notes the honeypots used a single PHP worker, which may make exploitation easier than on a busy production server. Even so, this is the first public, documented case of attackers getting working code execution through PHP2Shell.

3. Working exploit code is now public

On 25 October, a researcher won a public "steal my Bitcoin" challenge that guarded a wallet key behind an unpatched PHP server, after about 19 hours of attempts. The exploit chained two memory leaks to make PHP run system commands, and the researcher then published the proof of concept on GitHub. Separately, VulnCheck built an exploit that defeats ASLR, a standard memory protection, by chaining a memory leak with the PHP2Shell flaws.

Public exploit code lowers the bar for less skilled attackers, so expect attack volume to keep rising.

4. The scale of attack traffic

• Delft University of Technology's threat intelligence lab tracked more than 50,000 exploitation requests from over 600 IP addresses in 70 countries. 171 of those addresses went beyond probing and sent exploit code or malware droppers.
• Censys counted more than 34 million internet-facing PHP services still reporting vulnerable versions as of 23 October.
• Cloudflare reported tens of thousands of attempts within 45 minutes of disclosure and millions by the next day.

What has been walked back

Fast-moving incidents produce early reports that don't hold up. Two have been corrected:

• Sophos and the Mirai payload. Sophos analysed a Mirai-derived botnet sample called Potassium linked to PHP2Shell attempts, but says the payload was not delivered because its countermeasures blocked the attempt. It now describes the activity it saw as scanning and failed attempts. Our 26 October update originally described this as a successful deployment; we have corrected it.
• Palo Alto Networks and a European government agency. Palo Alto withdrew its claim linking PHP2Shell to an intrusion at a European government agency.

Neither correction makes PHP2Shell less dangerous. The CISA listing, the honeypot shells and the public exploit are all newer and stronger evidence than the reports that were withdrawn.

The third flaw, CVE-2026-115560: still no fix

PHP has not yet released a fix or a severity score for CVE-2026-115560, a related remote-code-execution path in session upload progress. The 21 October releases do not fix it, and PHP plans to address it in its next regular release. It only affects an unusual setup where an app switches its session serializer to the phpCopy to clipboard handler at runtime while upload progress is on, and no exploitation has been reported.

Until then, set session.upload_progress.enabled = 0Copy to clipboard in php.ini, your FPM pool or server config, not with ini_set() or .user.ini, where an application could override it. Restart every PHP worker afterwards.

What to do now

1. Patch every web-facing PHP runtime to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or a vendor package that backports both fixes. Our step-by-step fix guide has commands for every common platform.
2. Take unpatchable servers offline. CISA's guidance is that systems which cannot be secured should be disconnected until they can. With a public exploit out, a WAF alone is no longer enough for PHP 8.1 and older.
3. Restart workers and rebuild containers so nothing is still running the old binary.
4. Hunt from 17 October. Look for unusual multipart POST requests, memory-limit errors and worker crashes, and above all PHP or web server processes starting a shell, curl or wget, or making unexpected outbound connections. That is exactly what the honeypot attackers did after getting in.
5. Treat any sign of execution as an incident. Isolate the server, rebuild it from a clean image and rotate every secret it held: database passwords, API keys, Laravel APP_KEY and WordPress salts.

Running Node.js too?

The Node.js Brotli flaw from the same week now has its own name, Node2Shell, and a critical score. Read our Node2Shell update for what changed.

Need help?

Peham's Cloud & DevOps team can inventory your PHP servers, patch and verify them, upgrade end-of-life versions and check for signs of compromise.

Book a free 30-minute PHP2Shell security check and talk it through with our engineers.

Sources

• The Register: CISA confirms PHP2Shell under attack as researchers clock successful exploits
• BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks
• Cyber Security News: PHP2Shell exploited to win Bitcoin challenge, PoC released
• Security Affairs: Sophos on the undelivered payload, Censys and VulnCheck findings
• Machine.news: Palo Alto retracts PHP2Shell attack claim
• Cyber Kendra: CVE-2026-115560 status
• NCSC-NL: PHP2Shell operational tracker