Key facts
Each fact is linked to the source that supports it.- Unit 42 published its PHP2Shell threat brief on 23 October 2026 and updated it on 25 October at 14:15 PT. The update says: 'We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs.' It also says: 'We have retracted our previous update from October 23.' Palo Alto Networks Unit 42
- Unit 42 still describes an attack against a European government agency executed in the context of a vulnerable PHP application, but it no longer attributes initial access to CVE-2026-109618 or CVE-2026-109619. Palo Alto Networks Unit 42
- Unit 42 reports 22.6 million exposed instances potentially vulnerable in its Cortex Xpanse telemetry. That is an exposure estimate, not a count of compromised organizations. Palo Alto Networks Unit 42
- CISA KEV catalog version 2026.10.23 still lists neither PHP2Shell CVE. KEV absence remains a catalog observation, not proof that exploitation never occurred. CISA
What changed
On 23 October 2026, Unit 42 published a threat brief on CVE-2026-109618 and CVE-2026-109619. An update in that brief described post-compromise activity that the team initially thought was related to PHP2Shell, including an attack against a European government agency.
On 25 October at 14:15 PT, Unit 42 updated the brief again. It now says it is unable to confirm that initial access is associated with the specific PHP2Shell CVEs and has retracted its previous update from 23 October. The current page still describes an attack against a European government agency executed in the context of a vulnerable PHP application, but it does not establish PHP2Shell as the entry point.
What remains supported
The safe description is:
- an intrusion against a European government agency was reported;
- it occurred in the context of a vulnerable PHP application;
- Unit 42 could not confirm that the PHP2Shell CVEs provided initial access;
- the earlier post-compromise attribution was withdrawn.
It is not accurate to call this a confirmed PHP2Shell breach. It is also not evidence that PHP2Shell exploitation never happens. It is a correction to one specific attribution, and the distinction matters for incident responders and for anyone repeating the headline.
Why the retraction matters
Several 25–26 October reports repeated the earlier version, including claims about password hashes, MFA secrets, an NTLM relay tunnel and agentic AI-assisted post-exploitation. Those details may describe the intrusion, but they do not prove the initial-access vector. A retraction from the primary research source takes precedence over a news summary that has not been updated.
This is the same evidence discipline the site applies elsewhere: an observed attack, a suspected vulnerability link and a confirmed exploitation chain are separate states. The retraction does not change the patch guidance for CVE-2026-109618 or CVE-2026-109619, and it does not change the KEV status.
Current status
There is no new upstream PHP release in the 26 October check. The PHP2Shell fixes remain 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA KEV catalog 2026.10.23 still lists neither CVE. The separate CVE-2026-115560 session-upload advisory still has no named fixed release; keep session.upload_progress.enabled=0 where it applies.
Patch the runtime, restart every worker and verify the process that actually serves requests. The verification guide covers that sequence; the mitigation guide explains why interim controls are not a complete fix.
Sources for this page
- Full text read
- Metadata only
Revision history
| Time (UTC) | Recorded change |
|---|---|
| 26 October 2026, 04:11 UTC | Adds the Unit 42 retraction and preserves the distinction between an observed intrusion and a confirmed PHP2Shell initial-access link. |
| 26 October 2026, 04:11 UTC | Current published version. |
This is an independent summary written by PHP2Shell Live. It is not a republished article and is not an official notice from PHP, any vendor or any agency. Read the editorial policy.