Latest update · Status update
23 Oct: attack reports and PHP advisory
Security Affairs, citing Censys, reported an estimated 34.4M vulnerable PHP services; the reports reviewed do not confirm a real-world RCE.
PHP2Shell news and analysis
Reporting on the fixes, exploitation reports and unresolved questions. Each update keeps the source, event date and publication date separate.
-
Early assessment: patches and unknowns
What the first day established: fixes are confirmed, attempts documented, exposure estimates disagree and no mass compromise is confirmed.
-
Cloudflare: millions of attempts
Cloudflare deployed WAF rules before disclosure and tracked a steep rise in attacks. It still says customers must patch.
-
PHP2Shell attempt seen before patches
A honeypot attempt on 17 October predates the leak. SecurityWeek reports early PoCs, but attempts are not confirmed compromises.
-
Fake PoCs and a failed webshell attempt
Researchers describe unreliable public PoCs, prank repositories and one failed webshell attempt. The underlying flaw remains serious.
-
CERT-EU, NCSC and CISA issue alerts
Official advice is consistent: patch immediately, restart workers and isolate if needed. Some organisations took services offline.
-
Node.js fixes a Brotli decoder RCE
CVE-2026-111497 is a Node.js core flaw, not PHP2Shell or an npm package issue. Keep runtime and package inventories separate.
-
PHP Foundation: a structural failure
The Foundation says a 2024 audit showed signs, competing fixes stalled, and AI-assisted review forced the issue back in August 2026.
-
PHP ships fixes for two critical flaws
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix CVE-2026-109618 and CVE-2026-109619. The flaws sit in the runtime, so updating a CMS or plugin is not enough.