Asl matn EN tilida, manba saytidan olindi. Manba ↗

Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign.

Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22. However, those figures include defensive scanners and do not establish successful server compromises.

The activity targets CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, which carry CVSS scores of 9.2.

Both vulnerabilities affect the PHP engine and can enable unauthenticated remote code execution under specific conditions.

Because the weaknesses sit beneath application code, updating a content management system alone does not remediate the underlying exposure.

By release time, over 100 source IP addresses had deployed tooling using more than two dozen names, including an exploit kit advertising a CVE identifier in its User-Agent.

The most widespread kit sent POST requests to /index.php or /, used the User-Agent php2shell-109618, and supplied a multipart boundary of B7kQpoc618.

Requests targeted raw IP addresses rather than hostnames, typically hitting each host once or twice.

That pattern indicates opportunistic address-space scanning rather than targeting of named organizations.

Fastly identified more than ten candidate exploit kits through fixed or patterned multipart boundaries, with five linked directly to PHP2Shell by name, headers, or behavior.

Approximately one-third of the recorded traffic identified itself as defensive checking, although such labels cannot independently prove authorization.

CVE-2026-109618 involves an out-of-memory condition that interrupts initialization of internal request data, leaving cleanup routines handling inconsistent state.

The argument passed to zif_system is the command from the fake zend_string. The command executes with the privileges of the web server user (typically www-data).

Flowchart of exploitation (Source : Akatsuki Legion).

According to Akatsuki Legion technical analysis, the first PHP2Shell-named scanner appeared at 03:59 UTC on October 21, more than nine hours before the scheduled security release.

CVE-2026-109619 allows internal state to survive beyond the memory backing it, potentially exposing a subsequent request handled by the same worker to corrupted data.

These conditions distinguish PHP2Shell from vulnerabilities reliably triggered through a universal payload. Sansec’s updated assessment found that public proof-of-concept scripts did not work against default PHP installations.

By filtering out the known patched releases, the query successfully mapped out a persistent baseline of vulnerable infrastructure, recording 274 separate events across the timeline.

274 events in 30 days (Source : Akatsuki Legion).

Many required additional application weaknesses, including local file inclusion, or artificially vulnerable test environments. Consequently, widespread scanning should not be equated with widespread successful exploitation.

Recorded Future similarly warned that public repositories advertising exploit capabilities do not establish functional exploitation.

Some tools rely on invalidated theories, reinforcing the need to separate working attack chains from opportunistic probes and misleading demonstrations.

Defenders must also exclude unrelated attack traffic. Fastly found that two circulating PHP2Shell detection patterns overwhelmingly matched React2Shell activity instead.

The Next-Action header helped identify those requests, while multipart boundaries beginning —-wp2shell indicated a separate WordPress campaign rather than PHP2Shell.

Edge telemetry can reveal attempts but cannot reliably confirm execution. Investigators should correlate suspicious requests with PHP-FPM errors, Apache worker crashes, and unexpected outbound connections from PHP processes.

Boundary strings provide useful hunting leads, but rapidly changing User-Agent values and shared proxy infrastructure make simplistic signatures and IP blocklists unreliable.

Administrators should upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or install their distributor’s patched package. Older branches require verified backports or migration.

WAF protections can provide temporary coverage, but runtime patching remains essential because vulnerable request processing occurs before application code executes.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.