PHP2Shell exploits surge as attacks began before public disclosure

Attackers are aggressively targeting the PHP runtime using the PHP2Shell vulnerabilities, which carry a critical 9.2 severity rating. Cloudflare reports exploitation attempts have climbed into the millions, while Amazon detected activity as early as October 17, four days before the official disclosure. The flaws affect PHP's memory handling, potentially allowing unauthenticated remote code execution.

Technical details of PHP2Shell

• Affects CVE-2026-109618 and CVE-2026-109619.
• Critical severity rating of 9.2.
• Targets PHP memory handling, enabling unauthenticated remote code execution.
• Many attacks exploit the PHP session upload-progress path.
• Attackers are actively modifying payloads to bypass WAF protections.

Why it matters

Because these vulnerabilities affect the PHP runtime itself rather than specific plugins, a massive number of websites and content management systems are at risk.