PHP2Shell attack attempts continue with no confirmed compromises
Original title: Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
Wordfence logged more than 74,000 related attempts; fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Wordfence says exploit and probing attempts against CVE-2026-109618 and CVE-2026-109619 continued after PHP emergency updates on October 21. Its firewall intercepted more than 74,000 related attempts, including requests aimed at reading .env and wp-config.php. The company reports no confirmed compromises. Owners should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package containing both fixes, and restart every PHP worker. Updating WordPress does not update PHP.
Unconfirmed: Wordfence has not confirmed compromises or that sampled requests achieved code execution.
- A 10,000-event sample was collected from October 20 to October 22.
- Wordfence says it secures over 5,000,000 WordPress websites.
- Attempts use PHP multipart and session-upload-progress handling.
- The sampled request does not prove memory corruption or command execution.
- PHP workers must be restarted after a fixed release is installed.
Impact: attempted command execution and reads of config files
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
- 1.Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a package confirmed to contain both fixes.
- 2.Restart every PHP worker after updating.
- 3.Do not treat a WordPress update as a PHP patch.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | oast.fun | unique callback hostnames under services such as oast.pro, oast.fun and oast.online. Non-IP indicators for defenders P2SOK Nx |
| domain | oast.online | ack hostnames under services such as oast.pro, oast.fun and oast.online. Non-IP indicators for defenders P2SOK NxSP[0-9]+ SHLOK A |
| domain | oast.pro | nd through unique callback hostnames under services such as oast.pro, oast.fun and oast.online. Non-IP indicators for defenders |
| privacy@defiant.com | t. Close Questions? Contact our Privacy Team at: • Email:privacy@defiant.com • Mail: Defiant Inc. Attn: Privacy Issues, 1700 Westlake Av | |
| ipv4 | 103.147.220.17 | 2,263 9 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b 1,953 10 103.147.220.17 1,860 11 143.246.223.124 1,791 12 52.74.54.75 1,260 1 |
| ipv4 | 107.189.14.87 | 9 5,796 5 152.233.51.69 5,317 6 45.134.225.16 3,623 7 107.189.14.87 2,365 8 193.47.62.24 2,263 9 2409:40d2:204e:4be:2a1f:f9 |
| ipv4 | 140.245.32.169 | 0 648 18 217.112.152.168 619 19 203.78.119.133 616 20 140.245.32.169 616 Our Assessment Exploitation remains sensitive to the |
| ipv4 | 143.246.223.124 | be:2a1f:f9c9:a055:e00b 1,953 10 103.147.220.17 1,860 11 143.246.223.124 1,791 12 52.74.54.75 1,260 13 65.49.200.56 836 14 193 |
| ipv4 | 152.233.51.69 | ,856 3 185.196.220.132 7,146 4 185.161.210.29 5,796 5 152.233.51.69 5,317 6 45.134.225.16 3,623 7 107.189.14.87 2,365 8 1 |
| ipv4 | 167.254.242.130 | 7.111 775 15 85.137.56.188 672 16 85.137.53.26 664 17 167.254.242.130 648 18 217.112.152.168 619 19 203.78.119.133 616 20 1 |
| ipv4 | 181.215.186.252 | Address Blocked attempts Count 1 87.121.84.174 8,525 2 181.215.186.252 7,856 3 185.196.220.132 7,146 4 185.161.210.29 5,796 |
| ipv4 | 185.161.210.29 | 525 2 181.215.186.252 7,856 3 185.196.220.132 7,146 4 185.161.210.29 5,796 5 152.233.51.69 5,317 6 45.134.225.16 3,623 7 1 |
| ipv4 | 185.196.220.132 | ount 1 87.121.84.174 8,525 2 181.215.186.252 7,856 3 185.196.220.132 7,146 4 185.161.210.29 5,796 5 152.233.51.69 5,317 6 |
| ipv4 | 193.142.147.111 | 124 1,791 12 52.74.54.75 1,260 13 65.49.200.56 836 14 193.142.147.111 775 15 85.137.56.188 672 16 85.137.53.26 664 17 167.2 |
| ipv4 | 193.47.62.24 | 9 5,317 6 45.134.225.16 3,623 7 107.189.14.87 2,365 8 193.47.62.24 2,263 9 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b 1,953 10 |
| ipv4 | 203.78.119.133 | 664 17 167.254.242.130 648 18 217.112.152.168 619 19 203.78.119.133 616 20 140.245.32.169 616 Our Assessment Exploitation |
| ipv4 | 217.112.152.168 | 188 672 16 85.137.53.26 664 17 167.254.242.130 648 18 217.112.152.168 619 19 203.78.119.133 616 20 140.245.32.169 616 Our A |
| ipv4 | 45.134.225.16 | 7,146 4 185.161.210.29 5,796 5 152.233.51.69 5,317 6 45.134.225.16 3,623 7 107.189.14.87 2,365 8 193.47.62.24 2,263 9 24 |
| ipv4 | 52.74.54.75 | 3 10 103.147.220.17 1,860 11 143.246.223.124 1,791 12 52.74.54.75 1,260 13 65.49.200.56 836 14 193.142.147.111 775 15 8 |
| ipv4 | 65.49.200.56 | ,860 11 143.246.223.124 1,791 12 52.74.54.75 1,260 13 65.49.200.56 836 14 193.142.147.111 775 15 85.137.56.188 672 16 85 |
| ipv4 | 85.137.53.26 | 56 836 14 193.142.147.111 775 15 85.137.56.188 672 16 85.137.53.26 664 17 167.254.242.130 648 18 217.112.152.168 619 19 |
| ipv4 | 85.137.56.188 | 5 1,260 13 65.49.200.56 836 14 193.142.147.111 775 15 85.137.56.188 672 16 85.137.53.26 664 17 167.254.242.130 648 18 217 |
| ipv4 | 87.121.84.174 | locked attempts. # IP Address Blocked attempts Count 1 87.121.84.174 8,525 2 181.215.186.252 7,856 3 185.196.220.132 7,146 |
From the original article
10 min read at wordfence.com
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases.
By Chloe Chamberland · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.