One week after the PHP2Shell flaws went public, fewer than 53% of the organizations that were initially exposed are still vulnerable, according to new telemetry from Wiz Research. The same report explains why the attack traffic hitting Wiz's honeypots has not turned into break-ins there: the public exploit kits stall partway through a fragile, multi-stage chain.
PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. CISA has since added both to its Known Exploited Vulnerabilities catalog.
Exposure fell fast after disclosure
Wiz says the daily number of distinct internet-exposed machines vulnerable to PHP2Shell dropped by about 67% over the past few days, and the number of significantly affected organizations, those with at least one exposed and vulnerable instance, fell by about 47.9%. Among vulnerable exposed machines, the share running PHP 7.3 or earlier, versions that did not receive official backports, fell from 8.3% to 5.7% over five days. PHP is in use at 65% of organizations in Wiz's dataset.
Wiz cautions that the figures show the overall trend, not how much came from patching versus upgrading, retiring machines or cutting internet access, and that scan coverage can also move the numbers.
Why the public exploits keep stalling
Wiz captured two variants of an open source exploit kit. The older "legacy" chain sent a roughly 12 MB request that exceeded the honeypot's 8 MB post_max_size limit, so PHP never processed the malicious body. The newer chain got further: its first stage consistently exhausted PHP's memory, the condition the attack needs to leave a session pointing at freed memory. But the second stage, which tries to leak memory addresses back through a session cookie, failed in every run Wiz captured, and no source sent the final stage.
The researchers say the kit's memory layout was calculated for the official php:8.4.26-apache image with a 128 MB memory limit, and differences in builds, extensions and limits can change how the heap behaves. The chain also needs consecutive requests to land on the same Apache worker, so the kit ties up the other workers with stalled connections; one VPN address opened 399 of them. In Wiz's own testing, request timeouts combined with network latency were enough to stop the chain completing over the internet.
Some traffic branded as PHP2Shell was not exploiting the flaws at all. One Go tool reused a longstanding session-poisoning technique that only works if the target also has a separate local file inclusion bug, and it assumed an endpoint that exists in a proof of concept's lab environment.
Stalled exploits are no reason to delay the PHP update
Wiz has not seen successful end-to-end exploitation in its own telemetry, but it calls researcher Adel Karimi's honeypot data the most robust public evidence yet of exploit traffic followed by memory disclosure and code execution, while noting those targets used a favorable single-worker Apache mod_php setup. Wiz also says partners have privately disclosed exploits that work against a variety of targets, and it expects the barriers to shrink as skilled actors adapt the chain. Our earlier coverage found the same pattern, with attacks piling up but no confirmed break-ins. Apply PHP's security updates, or cut internet access to affected hosts until you can.
Indicators
- Exploitation attempts: 3[.]37[.]227[.]134, 103[.]151[.]172[.]95, 178[.]249[.]214[.]6 (VPN), 15[.]204[.]59[.]70, 162[.]35[.]99[.]94, 85[.]11[.]187[.]35
- Scanner plus exploitation attempts: 172[.]206[.]2[.]199, 135[.]136[.]19[.]197 (VPN)
- Payload server: 31[.]56[.]197[.]72
The gap between crashing PHP and owning it is real, but it is a gap measured in engineering effort, not luck, and the organizations still exposed are betting that nobody closes it first.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.