Attackers are throwing purpose-built exploit traffic at the PHP2Shell vulnerabilities, but so far nobody has shown that it works in the wild. Wordfence says its firewall has intercepted more than 74,000 exploit or probing attempts tied to the two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, and related attacks on the same upload surface, without observing a single confirmed compromise across the more than 5 million WordPress sites it protects.
That is reassuring, not a reason to wait. In Wordfence's analysis, Chloe Chamberland stresses that the requests show clear intent to run commands and steal secrets, and that a quiet log is not proof an unpatched server is safe. In Italy, meanwhile, the national agency CERT-AGID has measured how many public sector sites still advertise a vulnerable PHP build.
The traffic is more than generic probing
PHP shipped emergency fixes for both flaws on October 21, as we reported at the time. Wordfence analysed a 10,000-event sample collected from October 20 to 22, chosen around requests referencing PHP_SESSION_UPLOAD_PROGRESS, so it is not representative of all malicious traffic. It still found several distinct payload families rather than one copied proof of concept:
- 3,752 "P2S" attempts that Wordfence describes as apparent out-of-memory and state-corruption RCE attempts, padding multipart requests with repeated fields to shape memory and then trying to run commands.
- 1,139 Laravel serialized-object gadget-chain attempts, plus 2,534 other serialized-object payloads targeting classes from Monolog, Symfony, Guzzle, WordPress, ThinkPHP and others.
- 512 "NxSP" session-file poisoning attempts and 30 out-of-band upload canaries. Wordfence is careful here: these use the same multipart surface but depend on separate flaws or application behaviour, and should not be described as confirmed PHP2Shell exploitation.
The goals are consistent. Payloads echo markers such as P2S_OK, NxSP followed by digits, and SHL_OK to confirm execution, run id, uname -a and hostname, read environment variables, .env and wp-config.php, try to drop a PHP shell named wp2s.php into writable upload, plugin or theme folders, pull a second stage with curl or wget, and confirm execution through callback hosts under oast[.]pro, oast[.]fun and oast[.]online.
Why nothing has landed yet
Wordfence's own lab work explains the gap. In a specially configured PHP 8.5.11 Apache build it confirmed code execution for CVE-2026-109619, but the same proof of concept only crashed a normal optimized 8.5.11 build. For CVE-2026-109618 it reproduced the vulnerable-versus-fixed behaviour without achieving code execution. Success depends on PHP configuration, SAPI, loaded extensions, application classes and worker state, which Wordfence reads as a sign of how complex the exploit is.
650 Italian public sector addresses flagged
CERT-AGID's first scan, started October 22 against web addresses listed in Italy's Index of Public Administrations (IPA), found 650 URLs declaring a PHP version potentially vulnerable to PHP2Shell, 3.2% of the reachable addresses. The check was passive and read only the version in HTTP headers, so it cannot see backported fixes and does not confirm exploitability. Equally, a server that hides its version is not proven safe. The agency has notified the administrations concerned and asks every body to check subdomains and services outside the list too. More on Italy's exposure is on our Italy country profile.
Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers
The fix has not changed: install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package explicitly confirmed to contain both fixes, then restart every PHP worker. Updating WordPress does not update PHP. A further RCE path PHP flagged afterwards is a separate issue worth checking too. Defenders hunting in logs can search for the markers above and the busiest sources in Wordfence's list, led by 87[.]121[.]84[.]174 (8,525 blocked attempts), 181[.]215[.]186[.]252 (7,856) and 185[.]196[.]220[.]132 (7,146).
The pattern so far is a familiar one: a hard-to-weaponise memory bug, a flood of half-working exploits, and a window that stays open only for as long as servers stay unpatched. The absence of confirmed compromises buys defenders time. It does not change what an unpatched server is exposed to.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.