Public PHP2Shell scripts drive mass scans of internet-facing PHP
Original title: Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts
Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.
Public exploit scripts for CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, are being used to scan internet-facing PHP. Both flaws are scored CVSS 9.2 and can enable unauthenticated remote code execution under specific conditions, with the command running as the web server user. Fastly recorded about 250,000 requests from roughly 3,200 addresses through midday October 22, including defensive scanners. Sansec found public proof-of-concept scripts did not work against default PHP, so scanning is not the same as successful exploitation.
Unconfirmed: Request counts include defensive scanners and do not establish successful compromises; public PoCs failed on default PHP.
- Akatsuki Legion says the first named scanner appeared at 03:59 UTC on October 21.
- The widest kit posted to /index.php or / with User-Agent php2shell-109618.
- Fastly says about one-third of recorded traffic labeled itself as defensive checking.
- Some PHP2Shell detection patterns instead matched React2Shell or a WordPress campaign.
- Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Impact: Unauthenticated remote code execution as the web server user
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
- 1.Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a distributor backport.
- 2.Correlate suspicious requests with PHP-FPM errors, worker crashes, and unexpected outbound connections.
- 3.Treat WAF rules as temporary; request processing happens before application code.
- Vendors
- PHP
- Organizations
- FastlySansecRecorded FutureAkatsuki Legion
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
3 min read at gbhackers.com
Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign. Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.