PHP 2Shell has prompted a surge of activity after two critical PHP core vulnerabilities were disclosed, tracked as CVE-2026-109618 and CVE-2026-109619, with a CVSS of 9.2. The issues reside in the PHP engine itself and allow unauthenticated remote code execution via crafted HTTP requests, affecting all PHP versions that handle web requests. Oracle’s patch guidance was issued by PHP on 21 October, followed by widespread scanning and exploit attempts.
Cloudflare researchers reported tens of thousands of exploit attempts within 45 minutes of public disclosure, rising to millions by 22 October, though no confirmed successful remote code execution in the wild to date. Sophos’ analysis notes that attackers appear to be struggling to weaponise the flaws, with even their own team taking extra effort to develop a working exploit.
Evidence from Censys shows that, as of 23 October, more than 34.4 million PHP services were still running vulnerable versions. While mass exploitation has not been observed, researchers warn the risk is growing: a VulnCheck development has produced an exploit that can bypass ASLR by chaining the two flaws, indicating that a functioning weapon could emerge.
In observed attacks, malware traffic has linked to a Mirai-derived botnet variant known as Potassium, with attempts to download follow-on payloads, though delivery has been blocked in several cases. The malware can download additional files, perform DNS-based C2 lookups, and launch DDoS activity, with ENS resolution present but disabled in the samples studied. Patching is essential now: fixed PHP versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; older branches require vendor upgrades or as‑available fixes.
Cisco Talos cautions that the true impact will take time to evaluate, and that core-technology flaws tend to cascade across platforms. Proprietary or custom tooling may still be under development by advanced actors.