PHP2Shell campaign reaches several hundred victims, researcher estimates

SecurityWeek reports that PHP2Shell attacks, active for over a week, root Palo Alto firewalls but fail against WordPress; over 22.6 million exposed instances are potentially affected.

Dream research attributes the PHP2Shell chain to a suspected Chinese-nexus actor that gained root on Palo Alto firewalls to target US government organizations.

Palo Alto and Unit 42 officially confirm active exploitation against internet-exposed PAN-OS management interfaces and verify the attacker tooling reported by Dream Research.

A researcher analyzing the case says the attackers' exploit carries offsets for PHP builds 8.4.18 (including an flen64 variant), 8.4.26, 8.3.35, 8.3.30, 8.3.27, and 8.3.24; he says he has not validated that.

Researcher says the actor is reusing the previously exploited build, appears to use AI, and is running full intrusions against real organizations with ransomware intent.

An r/netsec thread points to a new live intrusion stream pairing the PHP chain with the Brotli decoder chain as 'php2bitcoin x brotli2coin'.

Researcher observes live full intrusions, assesses ransomware intent, and points to additional real victims.

Security firms report about six PHP2Shell exploitations, including a suspected Chinese campaign that breached U.S. government-affiliated servers.

Palo Alto Networks has confirmed Dream's report of attacks on exposed PAN-OS management interfaces; fewer than 0.01% of the installed base is potentially exposed and patched systems are not affected.

A new thread reports PHP2Shell chain activity across the Previdian network.

CISA ordered US federal agencies to patch the Linux kernel privilege escalation flaw chained with PHP2Shell in the wild.

Palo Alto Networks confirms active exploitation of the PHP2Shell flaws against internet-exposed management interfaces.

CISA added Linux kernel CVE-2026-46300 to KEV as a component of the same attack chain as the PHP flaws.

Researchers detail the attack: observed on October 25 and apparently AI-assisted, it chained PHP2Shell with a kernel privilege escalation exploit and hit a US government-affiliated network.

New report broadens the campaign's scope: 25 servers rooted across four countries, including three in a U.S. government-affiliated environment, with lateral movement into Active Directory.

Researcher says the original PHP2Shell flaw was discovered and exploited with the GPT 5.6-Sol AI model, and a Wiz researcher replicated it with another model.

Researcher reports capturing PHP2Shell exploitation in a deliberately exposed honeypot, reinforcing the already confirmed active activity.

New report details China-linked attackers chaining PHP2Shell with Fragnesia to compromise two servers of a US government-affiliated organization.

Actor claims breach of Barista, a Sri Lankan café chain with over 100 outlets, by exploiting these PHP flaws for unauthenticated remote code execution on an outdated server.

CISA confirms active exploitation of the PHP2Shell flaws and lists affected configurations: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

CISA and security researchers confirm successful exploitation of the PHP flaws, after earlier threat warnings were slow to materialize.

TechCrunch coverage notes PHP powers about 70% of the web's software after the US government exploitation warning.

CISA reports exploitation attempts of the PHP flaws, without detailing the kind of activity observed.

Imperva recorded 482,342 scanning and exploitation requests and 122,311 attack sessions in the first 24 hours after the PHP2Shell flaws were disclosed.

Social media post ties the flaws to the PHP2Shell nickname and credits Wiz Research with the research.

Researcher publishes benchmark on a realistic nginx and Apache mod_php setup (PHP 8.4.26), measuring success rates for the memory leak and command execution even with concurrent benign traffic.

Public demo shows PHP2Shell yielding a shell on MediaWiki, Symfony, Laravel and phpBB running unpatched PHP 8.2 to 8.5.

Incident opened.

CISA adds the two PHP2Shell flaws (CVSS 9.2), which enable unauthenticated remote code execution, to its KEV catalog and confirms active exploitation.

CISA adds both PHP flaws to its KEV catalog after confirming active exploitation.

Flaws dubbed PHP2Shell remain in the spotlight; XBow says it can identify vulnerable PHP versions and demonstrate real code execution on exploitable targets.

XBow's offensive team says it demonstrates real code execution on vulnerable PHP versions, depending on target configuration.

CISA added both flaws (CVE-2026-109618 and CVE-2026-109619) to the KEV catalog on October 26, 2026, officially designating them as exploited; a fix is available in PHP 8.5.12, with mod_php cited as the highest demonstrated risk.

CISA adds CVE-2026-109618 and CVE-2026-109619 to the KEV catalog, confirming active exploitation; the federal deadline to apply mitigations is October 29, 2026.

Delft Threat Intelligence Lab reports about 54,900 exploitation attempts against honeypots since Oct 21, from 608 IPs across 70 countries, with 171 IPs delivering code or droppers.

Researcher highlights the first good public php2shell exploit that turns the flaw into a remote shell.

Researcher reports successful exploitation of the flaw (PHP2Shell) on honeypot servers, with attackers executing shell commands to fetch additional payloads; no second-stage payload has been recovered so far.

Unit 42 says PHP2Shell exploitation attempts continue amid suspected North Korea global scanning activity, and it has retracted its earlier assessment that the attack on a European government agency involved these flaws.

A public challenge left $2,000 in bitcoin on a server running the flaw and, after more than 20 hours, no one has pulled off the exploit, only crashing the server.

TechCrunch publishes a retrospective on the two critical PHP flaws and the risk they posed to the web.

Report details a PHP2Shell attack on a European government entity, with MFA secrets and password hashes accessed within 2 hours, signs of agentic AI use in post-exploitation and suspected Lazarus-linked operators scanning 216 targets; a public Bitcoin-bounty challenge on a vulnerable PHP site still

Researcher reports confirmed exploitation of the PHP RCE (php2shell), and tests show the flaw is also exploitable behind reverse proxies such as Google Cloud Run's.

Unit 42 reports active exploitation of both flaws, with agentic AI post-exploitation and a European government case; zerodayalpha validates the bugs and lists fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Siemens, Schneider Electric, ABB and other industrial vendors confirm products affected by the PHP2Shell flaws.

A public challenge confirms practical exploitability: a researcher exploited the 'PHP2Shell' flaws on a deliberately vulnerable server and extracted a private key after about 19 hours, collecting the developer's bounty.

JPCERT updates the advisory with fixed PHP versions and Ubuntu, Red Hat and Peplink backports.