PHP2Shell: Exploitation Attempts and Remediation Trends

Wiz research has observed limited exploitation attempts against PHP vulnerabilities, with no successful end-to-end exploits publicly demonstrated to date. Post-disclosure of the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619), monitoring revealed a trend of reduced exposure: daily instances of Internet-exposed machines vulnerable to PHP2Shell decreased by approximately 67% over several days. The proportion of vulnerable machines running older PHP versions (7.3 or earlier) also decreased from 8.3% to 5.7%. Furthermore, the number of significantly affected organizations fell by roughly 47.9%, consistent with collective remediation efforts like patching and upgrading.
Exploitation attempts observed included variations using public exploit kit mechanisms, such as a legacy chain and a newer chain based on pure/mka1.py and pure/mkleakb.py. Attempts involving memory exhaustion succeeded in triggering error messages but failed to complete the necessary subsequent steps, such as leaking memory addresses required for full exploitation. Challenges observed included the difficulty of achieving reliable worker pinning and information leakage across different PHP builds and configurations. Unrelated attempts also showed activity using session poisoning techniques combined with local file inclusion vulnerabilities, which did not lead to successful code execution when relying on external endpoints.

* Wiz telemetry recorded an approximate 67% decrease in the daily number of distinct Internet-exposed machines vulnerable to PHP2Shell over the past few days following public disclosure on October 21, 2026.
* The proportion of vulnerable Internet-exposed machines running PHP version 7.3 or earlier fell from 8.3% to 5.7% over five days.
* The number of significantly affected organizations fell by approximately 47.9%.
* Exploitation attempts included using the PHP2Shell exploit mechanism and tools related to session poisoning and local file inclusion (LFI).
* One attempt using a multipart body containing 1,005 parts failed due to exceeding the configured request size limit of 8 MB postmaxsize on a honeypot.
* A variant of the exploit kit that attempted memory exhaustion resulted in PHP logging an error indicating memory exhaustion before reaching the expected code execution stage.
* An attempt to perform memory leaking failed in most runs, as heap contents were not successfully written to the session cookie for extraction.
* Successful end-to-end exploitation has not been observed in Wiz telemetry.
* One observed tool attempted to write PHP code into a session file via upload progress but relied on an external LFI endpoint to execute it.

The narrative presents a tension between the existence of known, documented attack methods and the practical reality of defense and evasion. The pattern of exploitation attempts highlights that public proof-of-concept code alone is insufficient for reliable large-scale compromise; operationalizing an exploit requires overcoming specific environmental constraints. The failure points—like discrepancies in PHP builds, memory limits, and the dependency on stateful processes (worker pinning)—reveal a critical gap between theoretical vulnerability discovery and applied threat engineering.
The analysis of the failed memory leak stages suggests that adversaries must evolve beyond simple chaining. When generalized tools fail against environment-specific configurations, it forces actors to invest more time in reverse-engineering the specific target's constraints rather than relying on generic public scripts. This implies a recurring pattern: exploiting system flaws is often just the first, least challenging step; achieving persistence and full control demands knowledge of the implementation details, which is where current tooling struggles most when faced with environmental variance.
The existence of unrelated attempts utilizing session poisoning alongside LFI underscores that attackers are pragmatic, adapting known concepts to available application entry points rather than strictly following a single exploit path. The overall trajectory suggests that while high-level patching addresses surface exposure, the deeper security challenge lies in hardening the runtime environment and eliminating the environmental variables that allow specific, configuration-dependent exploits to succeed against real-world deployments. What infrastructure remains vulnerable once remediation occurs?