How attacker target selection changes PHP2Shell exposure priorities

The PHP2Shell campaign reports are useful beyond the patch list. They show how an attacker may choose targets: collect public PHP banners, drop hosts that advertise fixed versions, avoid heavily filtered networks, rotate scanning nodes and keep activity slow enough to avoid rate-based alerts.

CYFIRMA captured a 216-host list and described operator claims of an expansion to 581 hosts. The captured figure is targeting evidence, not a list of confirmed victims. The operators reportedly used older PHP appearances and filtering behavior as selection clues. CYFIRMA also reported that nodes showing filtering or rate limiting were pulled from the active set.

The vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both unauthenticated RCE flaws rated CVSS v4.0 9.2. PHP fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. The selection logic does not change the patch requirement.…