The PHP2Shell flaws are no longer a theoretical risk. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both bugs, CVE-2026-109618 and CVE-2026-109619, to its list of vulnerabilities known to be exploited in real attacks, and gave federal agencies until October 29, 2026 to fix them. Amazon says the first exploitation attempt it saw came four days before the flaws were made public. If your site runs PHP and you have not updated, do it now: the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What changed since the patch came out?
When PHP shipped emergency fixes on October 21, the question was how fast attackers would turn the bugs into working attacks, given that AI tools made the complex exploits far easier to build. The answer: almost immediately. CISA had said the week before that it had not yet seen exploitation. It has now confirmed it.
Delft University of Technology’s threat intelligence lab logged 68,499 exploitation requests from 652 IP addresses in 73 countries since October 21, with 174 of those addresses sending actual attack code. Cloudflare CEO Matthew Prince said his network saw thousands of attempts in the ten hours before disclosure and millions shortly after.
How did attackers get in before the disclosure?
Nobody knows yet. Amazon Threat Intelligence said its MadPot honeypot, a decoy system AWS uses to study attackers, received a PHP2Shell attempt on October 17, four days before the planned disclosure and three days before details leaked on Hacker News. The request came through a commercial anonymising network. Variations in the payloads suggest more than one group was involved. Whether those early attempts would have worked on real servers is unclear.
Have real systems actually been broken into?
Yes, though the details vary in how well they are confirmed. The strongest evidence comes from Adel Karimi, detection lead at Perplexity, who recorded 35 shell commands launched through Apache on a test server on October 24, matching the first flaw. Security researcher Marcus Hutchins called it the highest quality confirmation of real-world exploitation he had seen.
A more alarming claim comes from security firm Dream, which says a chained attack rooted 25 servers, including 24 firewalls and systems in a US government-affiliated environment, by pairing PHP2Shell with a Linux kernel flaw. Dream pointed to a "Chinese-nexus" operation using AI tools including Claude Code, DeepSeek and Kimi, but had no direct proof those tools wrote the exploit. The Next Web, which reported it, said it had not verified the findings.
Not every early report held up. Sophos corrected a report of successful attacks after its data showed only scanning and failed attempts, and Palo Alto Networks’ Unit 42 withdrew its assessment of an attack on a European government agency. That is normal in the first week of a major flaw, and a reason to read breach headlines carefully.
What should site owners do now?
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. In WordPress, check under Tools, Site Health, Info, Server.
- If you cannot update, CISA’s advice is to take the system offline. PHP says no configuration change fully protects you, and the risk is highest with Apache mod_php.
- Check firewalls and appliances that run PHP in their management panels, not just websites.
- If you were exposed before patching, look for unexpected processes started by the web server and rotate passwords, database credentials and API keys.
This is the pattern Microsoft warned of when it said flaws now get weaponised in under 24 hours. PHP2Shell beat that: attacks started before the patch existed. See our Black October roundup for every major AI-era security incident this month.
Read The Next Web on CISA’s confirmation and Infosecurity Magazine on Amazon’s early detection.
