PHP2Shell Threat Escalates as Millions of Scans Reported, Urgent Patches Deployed

Security researchers have observed a dramatic rise in PHP2Shell scanning activity, with attempts now numbering in the millions worldwide, yet no confirmed cases of a successful breach have emerged.

The surge was noted shortly after the PHP development team issued emergency updates on October 21 to address two high‑severity flaws, identified as CVE‑2026‑109618 and CVE‑2026‑109619. Both vulnerabilities carry a CVSS rating of 9.2, signalling a critical risk level that could allow remote code execution on any system running an unpatched version of the language.

PHP, the scripting engine that powers a substantial portion of the internet’s dynamic sites, is installed on servers ranging from small blogs to large e‑commerce platforms. Because the vulnerabilities affect the core interpreter, virtually every active PHP deployment is theoretically exposed. The patches modify core parsing routines to block the malicious payloads that attackers attempt to inject via specially crafted requests.

Industry analysts caution that the absence of verified exploit success does not equate to safety. The sheer volume of automated probes suggests that threat actors are testing the waters, likely hoping to discover a configuration or version that slips through the defensive net. Historically, similar “shell” exploits have leveraged overlooked default settings or outdated extensions to gain a foothold.

In response, major hosting providers and content‑delivery networks have begun rolling out the updates automatically, while security advisories from organisations such as the Open Web Application Security Project (OWASP) stress the importance of immediate remediation. Administrators are also urged to audit server logs for anomalous PHP request patterns, which could indicate probing activity.

Experts predict that the next phase of the campaign may shift from scanning to targeted exploitation, particularly against sites that lag in patch adoption. The rapid dissemination of the emergency fixes underscores the collaborative effort between the PHP core team and the broader security community to mitigate high‑impact threats.

For operators who have not yet applied the patches, the recommendation is clear: download the latest PHP releases from the official repository, verify the integrity of the binaries, and restart affected services without delay. Continued vigilance, combined with routine updating practices, remains the most effective defense against evolving web‑application vulnerabilities.