PHP2Shell Exploitation Surge: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619
In October 2026, two critical PHP remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—triggered a global exploitation wave within hours of public disclosure. Cloudflare observed thousands of exploit attempts in the 10 hours before announcement, escalating to millions within two hours post-disclosure. Check Point Research reported that 10% of organizations worldwide faced exploitation attempts within 24 hours. Complicating response efforts, over 99% of discoverable PHP instances had not patched within the first day, and roughly 73% ran unsupported PHP branches, leaving attackers a vast, largely undefended attack surface across web servers, storage appliances, cameras, and physical access-control systems. PHP2Shell underscores a persistent and worsening gap between attacker speed and enterprise patch velocity. As organizations increasingly rely on containerized, hybrid, and multi-cloud deployments, unpatched PHP surfaces embedded in firmware, legacy applications, and third-party software create systemic risk. The incident highlights why runtime network controls, east-west segmentation, and egress enforcement are essential complements to patching programs—especially when patches cannot be applied instantly or at all.
Kill Chain
