PHP2Shell: Finding the Needles in a 250,000 Request Haystack

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and capable of unauthenticated remote code execution across web-serving PHP configurations, with patches released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Fastly observed scanners using PHP2Shell-branded tools more than nine hours before the coordinated October 21, 2026 release, eventually recording roughly 250,000 requests from about 3,200 IP addresses, although many probes appeared to be benign self-assessments. Because exploitation depends on triggering faulty memory conditions rather than sending a distinctive payload, multipart boundary patterns are presented as a more reliable detection signal than User-Agent strings, IP addresses, or request sizes. Investigators should distinguish genuine PHP2Shell attempts from overlapping React2Shell and wp2shell traffic, which can resemble PHP-focused exploit scans but target different technologies or vulnerabilities. Since edge telemetry cannot confirm compromise, organizations are advised to patch promptly, review origin logs for PHP worker crashes and suspicious outbound connections, avoid indiscriminate IP blocklists, and use structural WAF protections where available.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.