Wiz reports limited PHP2Shell exploitation attempts after disclosure
Original title: PHP2Shell: Exploitation Attempts and Remediation Trends
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
Wiz says that since disclosing CVE-2026-109618 and CVE-2026-109619 in PHP on October 21, it has seen only a limited number of exploitation attempts and no public proof of concept for complete, general exploitation. Two open-source kit variants reached Wiz honeypots but failed before obtaining needed memory addresses. Wiz also saw PHP2Shell-branded tools that instead used session poisoning and a separate local file inclusion flaw. Exposure among observed organizations has dropped, though scan coverage can affect the figures.
Unconfirmed: Wiz has not identified a public end-to-end PoC, while partners privately claim working exploits against varied targets.
- Distinct exposed vulnerable machines fell about 67 percent over a few days.
- Organizations with at least one exposed vulnerable instance fell about 47.9 percent.
- Less than 53 percent of initially affected organizations remained vulnerable after one week.
- The share on PHP 7.3 or earlier fell from 8.3 percent to 5.7 percent.
- Partners privately showed Wiz exploits that work against a variety of targets.
Impact: Incomplete remote exploitation attempts against exposed PHP
| Product | Affected |
|---|---|
| PHP | — |
- 1.Patch, upgrade, retire, or restrict internet access to PHP instances vulnerable to PHP2Shell.
- 2.Review logs for multipart PHP-CGI requests that exhaust memory or stall Apache workers.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.151.172.95 | tory. A later attempt against Roundcube In a later attempt, 103.151.172[.]95 sent a longer sequence from the legacy chain. It included |
| ipv4 | 135.136.19.197 | .56.197[.]72 2026-10-21 2026-10-21 C2 (payload server) IPv4 135.136.19[.]197 2026-10-26 2026-10-26 Scanner + exploitation attempt (VPN |
| ipv4 | 15.204.59.70 | ther attempts We also saw failed exploitation attempts from 15.204.59[.]70 and 162.35.99[.]94 , but these scanners did successfully |
| ipv4 | 162.35.99.94 | so saw failed exploitation attempts from 15.204.59[.]70 and 162.35.99[.]94 , but these scanners did successfully exploit Adel Karimi |
| ipv4 | 172.206.2.199 | 11.187[.]35 2026-10-21 2026-10-21 Exploitation attempt IPv4 172.206.2[.]199 2026-10-25 2026-10-25 Scanner + exploitation attempt IPv4 |
| ipv4 | 178.249.214.6 | a large body, sends a single byte and stalls: One address, 178.249.214[.]6 , opened 399 of these connections alongside 400 GET reque |
| ipv4 | 31.56.197.72 | 4[.]6 2026-10-24 2026-10-24 Exploitation attempt (VPN) IPv4 31.56.197[.]72 2026-10-21 2026-10-21 C2 (payload server) IPv4 135.136.19 |
| ipv4 | 3.37.227.134 | y chain The first request to our PHP-CGI honeypot came from 3.37.227[.]134 . It matched the kit’s older chain, found under archive/l |
| ipv4 | 85.11.187.35 | ploit either vulnerability. The earliest such traffic, from 85.11.187[.]35 , matched a Go port of “Chain A” from WoYinDao/CVE-2026-1 |
From the original article
7 min read at wiz.io
Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.
By Yaara Shriki · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.