PHP2Shell, a week on: millions of exploit attempts, no confirmed break-ins yet. Germany's BSI says the flaws (CVE-2026-109618/109619) are harder to exploit than expected; CISA and the Dutch agency report no confirmed misuse.
The worrying part is the patching. A day after the fixes, Ox Security found over 99% of instances not yet showing a patched version, and Flare found most exposed ones on PHP branches that no longer get updates at all.
If you run PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On 8.1 or older there is no patch, only an upgrade.
https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-27 19:33:48 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-27 19:33:48 UTCEvent JSON
{
"id": "54481387fdf281740e91bb1e696bf835022dbad124479afc0a3836a8dede67ff",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1793129628,
"kind": 1,
"tags": [],
"content": "PHP2Shell, a week on: millions of exploit attempts, no confirmed break-ins yet. Germany's BSI says the flaws (CVE-2026-109618/109619) are harder to exploit than expected; CISA and the Dutch agency report no confirmed misuse.\n\nThe worrying part is the patching. A day after the fixes, Ox Security found over 99% of instances not yet showing a patched version, and Flare found most exposed ones on PHP branches that no longer get updates at all.\n\nIf you run PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On 8.1 or older there is no patch, only an upgrade.\n\nhttps://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches",
"sig": "4cb183508bdae01e2d6e47f4cc5768bc5019380d63c3910c85a590c0ccb412dab23d570f2fa5c55ec30fdded5096436e732bf89a3c0e92ac905cf177518dcf7f"
}