Is PHP2Shell Exploited in the Wild? Latest Status
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) leaked before its patches. Amazon saw a first attempt four days before disclosure, other security companies reported attempts within hours, while government agencies had not confirmed exploitation. This page collects who said what, and when, so you can judge the risk to an unpatched server.
Short answer: attack attempts against PHP2Shell were seen from October 21, 2026, and Amazon reported one as early as October 17. No confirmed hack had been published when we checked, and PHP2Shell was not on the CISA KEV list. Assume your server is a target and update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
PHP2Shell exploitation reports from security companies
| Source | What it reported |
|---|---|
| Amazon (MadPot honeypots) | First PHP2Shell attempt seen on October 17, four days before public disclosure, with more from about 02:00 to 08:00 UTC on October 21. Public proof-of-concept code was used against its sensors within hours of the patch. |
| watchTowr | Exploitation observed in the wild from October 21 in its honeypot network. Its head of threat intelligence said nobody had been successful yet. |
| Cloudflare | Its CTO reported early attacks at 07:43 UTC on October 21. Cloudflare saw attack traffic against customers, with attackers changing payloads to get past its rules. It did not say any customer was compromised. |
| Hadrian | Says it sees exploitation at scale, mostly through PHP's session upload progress feature. No counts given. |
| Patchstack | Hosting partners reported multiple active exploitation incidents at 07:34 UTC. By 13:57 UTC its own data showed probing, with no hard evidence of breaches. |
| Aikido | Said exploitation had been reported in the wild, without technical details. |
| Huntress | Had not seen exploitation on its partners' systems as of 20:30 UTC on October 21. |
| Cisco Talos | No in-the-wild exploitation seen as of 14:00 UTC on October 21. |
| CrowdStrike | Reproduced the attack in its own testing; reported no in-the-wild exploitation. |
| Imperva | No traffic matching PHP2Shell patterns during its monitoring before disclosure. |
What government agencies said about PHP2Shell attacks
| Agency | Status |
|---|---|
| CISA (US) | Had not observed exploitation when its alert was published. Not on the Known Exploited Vulnerabilities list at 21:03 UTC on October 21. |
| NCSC-NL (Netherlands) | No active exploitation detected yet. |
| CERT-EU | No confirmed exploitation, but proof-of-concept code is circulating. |
| PHP Foundation | Knew of no working public exploit at release time. |
| UK NCSC | Told operators to update, to take systems offline if they could not protect them, and to check for compromise. |
Why the PHP2Shell reports disagree
Each company sees different traffic. Honeypots and CDNs see every scan and attempt aimed at them, so they report attacks early. Endpoint and incident-response companies only report exploitation when an attack succeeds on a customer system. Agencies wait for confirmed cases. An attempt is not a breach, but attempts show that attackers are already scanning for unpatched PHP.
Researchers also say that most public proof-of-concept code does not work reliably. That is no reason to wait: attackers changed their payloads within hours of the leak, according to Cloudflare.
How PHP2Shell attacks reach a server
The vulnerable code runs while PHP reads an incoming request, before your application starts. That is why updating WordPress, Drupal or plugins does not help, and why Apache with mod_php is the most exposed setup. Hadrian's report that attacks mostly use the session upload progress feature matches one of the official temporary measures, turning that feature off. See PHP2Shell mitigation for the full list, and the two CVEs for background.
What to do now
- Check your version with the PHP2Shell checker or
php -v. - Update PHP using the patch guide. On Linux distributions, compare the fixed package versions.
- Keep your WAF on until you have patched. Cloudflare's PHP2Shell rules are on by default on every plan.
- If you were unpatched on October 20 or 21, go through the was I hacked checklist.
Status checked on October 21, 2026. Reports are changing quickly; this page will be updated as agencies and vendors publish more.
PHP2Shell exploitation FAQ
Is PHP2Shell being exploited?
Several security companies reported attack attempts from October 21, 2026, including watchTowr, Cloudflare, Hadrian and Patchstack. Government agencies such as CISA, NCSC-NL and CERT-EU had not confirmed exploitation when they published. Treat it as actively targeted and update PHP now.
Is PHP2Shell on the CISA KEV list?
No. When checked at 21:03 UTC on October 21, 2026, CISA's Known Exploited Vulnerabilities catalog listed neither CVE-2026-109618 nor CVE-2026-109619. CISA said it had not observed exploitation at the time of its alert.
Is there a public exploit for PHP2Shell?
Proof-of-concept code is circulating, and CERT-EU and Unit 42 both noted it. Researchers report that very few of the public versions work reliably. That does not make an unpatched server safe, because attackers keep adapting their payloads.
Were any websites actually hacked?
We found no published case of a confirmed compromise through PHP2Shell. watchTowr said attempts it saw had not succeeded yet, and Cloudflare did not say any customer was compromised. The many sites that went offline did so as a precaution.
What should I do if my site was unpatched on October 20 or 21?
Update PHP first, then go through the post-patch checklist: review accounts, files and logs, and rotate secrets the server could read.