Researchers confirmed the exploitation of PHP2Shell vulnerabilities, generating 35 shells from two IP addresses on October 24.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | No | - |
| CVE-2026-109619 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking (2026-10-25)
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors (2026-10-21) - SecurityWeek
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws (2026-10-21)
Business impact
Organizations may face unauthorized access and potential data breaches, impacting operations and potentially leading to financial losses and legal issues.
Users affected
Users and customers may experience data theft, service disruptions, and loss of trust, necessitating prompt security measures.
Build these skills
Sources
- PHP2Shell Exploitation Moves From Probes to Working Shells (SecurityWeek)
