PHP2Shell: Exploitation Attempts and Remediation Trends

The number of vulnerable PHP servers drops sharply within a week of a new vulnerability disclosure.

Wiz research has been monitoring exploitation attempts for PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and has observed limited activity with no publicly disclosed successful end-to-end exploits. While some partners have privately shared working exploits against specific targets, general exploitation remains unproven. Following public disclosure on October 21, 2026, Wiz telemetry indicated a significant decrease in vulnerable internet-exposed machines, with a 67% drop in daily distinct vulnerable instances and a 47.9% reduction in affected organizations within one week. This decline is attributed to patching, upgrading, retiring machines, and restricting internet access. Observed exploitation attempts utilized variants of an open-source exploit kit, with the newer variant consistently causing memory exhaustion but failing to leak process memory. The legacy variant faced request size limits or failed to trigger the intended memory exhaustion. Challenges in achieving reliable exploitation include difficulty in creating generalized exploits across different PHP versions and configurations, and the need for precise worker pinning and memory leak success.

Despite public disclosure of significant PHP vulnerabilities, attempts to exploit them in the wild have been largely unsuccessful due to technical limitations in the exploit kits. The observed exploit variants struggle with consistent memory exhaustion and reliable process memory leaks, which are critical for a complete exploit chain. These failures highlight the inherent difficulty in developing generalized exploits that function across diverse PHP environments and deployment configurations, underscoring the gap between proof-of-concept code and robust, operational attack tools.

The rapid decrease in exposed vulnerable systems, however, indicates a proactive security posture from organizations responding to disclosures. This trend suggests improved patching and remediation speeds within the industry, even as threat actors work to overcome the technical hurdles of exploit development. The ongoing cat-and-mouse game between vulnerability discovery, exploit creation, and remediation will continue to shape the landscape of web application security.