PHP2Shell: Exploitation Attempts and Remediation Trends

Following the disclosure of two major PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) on October 21, 2026, Wiz Research observed a significant 67% decrease in vulnerable Internet-exposed machines within days, with affected organizations dropping by approximately 48% as entities implemented patching, upgrades, and access restrictions. While exploitation attempts have been limited and no complete public proof-of-concept has emerged, the security community has documented various attack variants including PHP2Shell-branded tools that exploit unrelated vulnerabilities like session poisoning and local file inclusion flaws.