PHP2Shell: Exploitation Attempts and Remediation Trends | Wiz Blog
Last week, we published a report describing two major vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619).
This post summarizes what we have observed in terms of remediation efforts and exploitation attempts across real world environments and in our own honeypot data to date and shares findings from our ongoing investigation into these activities.
We also saw failed exploitation attempts from 15.204.59[.]70 and 162.35.99[.]94 , but these scanners did successfully exploit Adel Karimi's honeypot , which was a likely contributing factor to CISA’s decision to include PHP2Shell in their KEV list .
Last week, we published a report describing two major vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619); we will continue monitoring developments and update this post as new evidence emerges.
Since then, alongside much of the security industry, the the outlet's team has been monitoring for related activity in the wild and reviewing publicly available exploit code.
For reference, our data shows that PHP itself is in use by 65% of organizations in our dataset.
Following PHP2Shell’s public disclosure on October 21, 2026, Wiz telemetry has recorded an approximate 67% decrease in the daily number of distinct Internet-exposed machines vulnerable to PHP2Shell over the past few days.
Together, these observations are consistent with organizations collectively reducing their exposure through a combination of patching, upgrading, retiring affected machines and restricting internet access (note that this data shows the overall trend, but does not establish the relative contribution of each remediation strategy; scan coverage and size of observed population can also affect the overall reported numbers over time).
The first full exploit stage used a multipart body containing 1,005 parts, including a field named big filled with roughly 12 MB of padding: According to the kit’s notes, this stage attempts to exhaust memory during a session reset, leaving the session state available for a later request.
So far, we have observed a limited number of exploitation attempts in our telemetry and have not identified a publicly available proof of concept (PoC) demonstrating complete, general end-to-end exploitation against an arbitrary target.
We have so far observed the following types of activities in this context: Attempts using the PHP2Shell exploit mechanism, with techniques matching those of public PoCs .
What happened
This post summarizes what we have observed in terms of remediation efforts and exploitation attempts across real world environments and in our own honeypot data to date and shares findings from our ongoing investigation into these activities.
We also saw failed exploitation attempts from 15.204.59[.]70 and 162.35.99[.]94 , but these scanners did successfully exploit Adel Karimi's honeypot , which was a likely contributing factor to CISA’s decision to include PHP2Shell in their KEV list .
What changed
Last week, we published a report describing two major vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619); we will continue monitoring developments and update this post as new evidence emerges.
Who is affected
Since then, alongside much of the security industry, the the outlet's team has been monitoring for related activity in the wild and reviewing publicly available exploit code.
For reference, our data shows that PHP itself is in use by 65% of organizations in our dataset.
Why it matters
Following PHP2Shell’s public disclosure on October 21, 2026, Wiz telemetry has recorded an approximate 67% decrease in the daily number of distinct Internet-exposed machines vulnerable to PHP2Shell over the past few days.
Together, these observations are consistent with organizations collectively reducing their exposure through a combination of patching, upgrading, retiring affected machines and restricting internet access (note that this data shows the overall trend, but does not establish the relative contribution of each remediation strategy; scan coverage and size of observed population can also affect the overall reported numbers over time).
Technical details
The first full exploit stage used a multipart body containing 1,005 parts, including a field named big filled with roughly 12 MB of padding: According to the kit’s notes, this stage attempts to exhaust memory during a session reset, leaving the session state available for a later request.
So far, we have observed a limited number of exploitation attempts in our telemetry and have not identified a publicly available proof of concept (PoC) demonstrating complete, general end-to-end exploitation against an arbitrary target.
We have so far observed the following types of activities in this context: Attempts using the PHP2Shell exploit mechanism, with techniques matching those of public PoCs .
Response
The failed leaks highlight a broader challenge: building a generalized exploit that works reliably across PHP versions and deployment configurations is difficult.
What remains unknown
So far, we have observed a limited number of exploitation attempts in our telemetry and have not identified a publicly available proof of concept (PoC) demonstrating complete, general end-to-end exploitation against an arbitrary target.
Attribution
Wiz Research: Last week, we published a report describing two major vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619).
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.