On 21 October the PHP team released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”). Back then the question was how fast you could patch. A week later the question has changed: were you attacked in the meantime, and what can an attacker do once PHP is breached? 4 daysattacks reported before the patches came out50,000+exploitation requests tracked by TU Delft600+ / 70IP addresses / countries8new CISA KEV entries this week, 4 of them server software

What happened since 21 October

Attacks started before the patches. According to reports (Amazon Threat Intelligence, among others), exploitation began about four days before the fixed versions were released. Honeypot data later confirmed successful attempts, for example against Apache with mod_php on PHP 8.4.26 .

CISA confirmed it on 26 October. Both PHP flaws are in the Known Exploited Vulnerabilities catalog, with a deadline of 29 October for US federal agencies.…