Security firm detected an attempted exploitation of the PHP2Shell vulnerabilities against its MadPot honeypot on October 17, 2026, before public disclosure. The attempt originated from IP address 103.216.220[.]92, geolocated to Australia and associated with a commercial anonymization network. Researchers described the activity as largely a one-off probe, although the source of the threat actor’s exploit information remains unclear.

Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities carry a CVSS score of 9.2 and enable unauthenticated remote code execution (RCE) on affected PHP systems. The flaws affect PHP 7.x and 8.x releases, potentially exposing reachable endpoints regardless of the CMS, framework, or plugins in use.

Following the emergency security patches released on October 21, 2026, researchers observed multiple proof-of-concept exploits and additional attacks originating from anonymized infrastructure. Variations in payloads suggest multiple threat actors are involved.

Another Security Researcher reported detecting its first PHP2Shell request on October 21 at 8:36 a.m. UTC, highlighting rapid exploitation activity. Security vendors also observed widespread scanning, evolving payloads designed to bypass protections, and more than 60,000 suspicious requests blocked by one web operations platform.

Cybersecurity agencies, including CISA, FBI, NSA, and the UK's NCSC, urged immediate remediation. Organizations should apply security updates, identify exposed PHP deployments, upgrade unsupported versions, and monitor for suspicious PHP processes launching command shells or downloading files. Where patching is delayed, vulnerable services should be restricted or temporarily taken offline.