The escalation of PHP2Shell exploits continues, despite concerns that the initial reaction has not translated into timely patching.
The paired PHP flaws, identified as CVE-2026-109618 and CVE-2026-109619, possess a Common Vulnerability Scoring System (CVSS) score of 9.2, indicating severe risk. Given that roughly 70% of websites utilizing an identifiable server-side language operate on PHP-based platforms like WordPress, the widespread exposure is significant.
Ox security noted in a blog post dated October 26 that five days after disclosure, the situation remains largely unchanged, with 93.6% of systems still vulnerable. Moshe Siman Tov Bustan stated, "The panic hasn't turned into patching." He further elaborated that "Remediation is too slow, while everyone panics about PHP CVEs, remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild."
Censys reported in its PHP2Shell survey on Tuesday that only about 11.2 million Internet-facing PHP services are showing patched versions. This figure is complicated because certain "vulnerable" services might already have fixes applied via backported updates in Linux distributions without altering the reported version number. Furthermore, 32.5 million systems still report running unsafe PHP versions.
The situation is compounded by the unknown status of 61,303,506 PHP services, which constitutes 58% of all detected instances, and many are likely running unsupported PHP versions. Flare's October 22nd report tracked 2.2 million PHP service records, finding that "nearly three quarters advertised a PHP branch no longer supported by the PHP project." Mallory, another security firm, found that approximately 1.9 million internet-facing services are running unsupported PHP versions, representing about 73.5% of surveyed services.
Ramy Rahman, senior principal solutions engineer at ArmorCode, commented on the added difficulty, stating, "The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes."
The National Security Agency (NSA) advised that "All organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities..." and recommended taking systems offline if an immediate update was not possible. While entities like the Wikimedia Foundation and Internet Archive took action, most organizations did not.
The US government mandated remediation for Federal Civilian Executive Branch agencies through the Cybersecurity and Infrastructure Security Agency (CISA), setting a deadline of Thursday, October 29, 2026. Despite these mandates, attacks are ongoing, with the CVE reports now listed in CISA's Known Exploited Vulnerabilities catalog.
Adel Karimi, detection and response lead at Paerplexity AI, reported that his honeypots logged evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26, a pre-patch version. Matthew Prince, CEO of Cloudflare, posted on X that "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now."
These data points illustrate a critical operational gap where vulnerability disclosure is not translating into rapid defensive implementation across the ecosystem. The prevalence of unsupported versions significantly elevates the remediation burden beyond simple version patching, introducing application compatibility challenges for infrastructure operators.
