PHP2Shell Exploitation Status: What Is Confirmed So Far

As of 23 October 2026, widespread attempts to exploit PHP2Shell are reported by several security companies, the earliest dated 17 October, and no public source has documented a confirmed successful compromise. Neither CVE-2026-109618 nor CVE-2026-109619 is on CISA's Known Exploited Vulnerabilities (KEV) catalog as of our check at 15:32 UTC on 23 October.

That is the honest summary: attackers are trying, the reports disagree on how much of it works, and nobody has published a verified break-in. None of that changes what you should do. If your server runs PHP, install the fix and restart PHP now.

This page lists every public report we have checked, with dates and links, newest first. It is a moving story, so treat every line as "as of" its date.

Public Reports, Newest First

Each row is what the source itself said, on the date shown. Where we could not link, the source is named so you can find it.

Two more comments are worth knowing. watchTowr, quoted by SecurityWeek, said "The exploits being sprayed indiscriminately either don't work at all, test for timing-based differences, or crash the target." And Amazon wrote that "Additional proof-of-concept exploits appeared within hours, and we saw them used against our sensors almost immediately."

CISA KEV Status

CISA describes its Known Exploited Vulnerabilities catalog as "the authoritative source of vulnerabilities that have been exploited in the wild" and says organizations should use it "as an input to their vulnerability management prioritization framework."

The catalog had not changed since 21 October at the time of our check. Not being on KEV does not mean "safe." CISA's own 21 October alert tells organizations to "Apply the patch immediately, prioritizing internet-facing systems," and says those that cannot update, or that run PHP 8.1 or older, "should take PHP-based systems offline until they can be patched or updated." A KEV listing could appear at any time.

What Is Contested

Are default configurations exploitable?

Sources disagree. Calif, one of the research teams, says the flaws are "always exploitable under default configurations," and Datadog says "PHP's default memory limits are vulnerable." On the other side, PHP's own CVSS vectors mark attack complexity as high, Red Hat says remote code execution on its standard PHP-FPM setups "is difficult in practice and typically requires non-default behavior," and Fastly says existing exploits need knowledge of the exact PHP build, so "most deployments may be 'safe' from RCE. Do not assume this holds true for you." Beazley adds that "no single exploit works across all PHP versions and configurations." What everyone agrees on: PHP considers risk highest for Apache with mod_php, and every source says to patch.

Has anyone actually been hacked?

No public source we checked documents a confirmed successful compromise through PHP2Shell as of 23 October 2026. The reports above describe attempts, scanning and blocked traffic. That could change quickly, and a lack of public reports does not prove your server was untouched.

Did exploit details leak before the release?

The PHP Foundation says the CVE IDs leaked on 20 October with a wrong score and "No technical details leaked," though a Calif video was published by mistake and copies circulated. Beazley says proof-of-concept code "leaked from escrow." Amazon's 17 October sighting says "it remains unclear how the actor acquired exploit information prior to disclosure."

Was the patch bypassed?

Beazley notes "multiple sources claim that the original patches for CVE-2026-109619 could be bypassed." We found no primary source for a bypass. PHP treats CVE-2026-115560, published 23 October, as a separate, unlikely issue and suggests keeping session.upload_progress.enabled=0 until its next regular release. See our interim mitigations guide.

Were site outages caused by attacks?

Reuters reported government websites in Europe going offline on 21 October. No source we checked attributes those outages to attacks; they are described as operators patching or following take-offline advice.

What "Observed in the Wild" and "Attempts" Mean for You

These phrases sound alarming, so here is what they usually describe:

• Honeypot sightings. Amazon's MadPot and watchTowr's Attacker Eye are decoy servers built to attract attacks. A hit there proves someone is sending exploit traffic, not that a real site was breached.
• Firewall matches. When Cloudflare says it "observed attack traffic," that means requests matching its PHP2Shell rules reached its network. Blocked traffic is an attempt.
• Scanning. Datadog describes "broad untargeted scanning": automated tools probing huge numbers of sites, whether or not they run vulnerable PHP.
• Exploitation or compromise. An attacker actually running code on a server. This is the step no public source has confirmed for PHP2Shell as of 23 October.

For you as an owner, the practical meaning is simple. Unpatched internet-facing PHP servers are being probed right now, so the window to patch quietly is closed. Bitdefender also warns that "A successful exploit can return HTTP 200 and leave the worker running. Crash logs measure attempts, not compromises." In other words, a clean-looking error log is not proof either way.

Amazon published a short list of IP addresses but says they "include shared anonymization infrastructure" and advises organizations to "investigate any observations involving these addresses as opposed to blocking." Don't rely on IP blocklists as your protection.

What to Do, Whatever the Status

1. Patch. Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package. Our fixed versions table covers every branch.
2. Restart every PHP worker so the fix is actually running.
3. Look back to at least 17 October 2026. Amazon says to "investigate from at least starting on October 17th." Our guide was my site hacked through PHP2Shell lists the signs, and how to check if your website has been hacked covers free tools.
4. If you find something, follow a plan. Use our first-hour incident response plan before you start deleting files.

New to the topic? Start with what PHP2Shell is.

How We Keep This Page Current

We re-check the sources in the table and CISA's KEV catalog and update this page when a primary source changes. Every row carries the date the source itself gives. If a vendor revises its statement, we update the row and the changelog below.

Changelog: Last checked 23 October 2026 (CISA KEV feed checked at 15:32 UTC; php.net, NVD and vendor pages re-read the same afternoon).

Conclusion

As of 23 October 2026, PHP2Shell exploitation attempts are widespread and started before the fix was public, CISA has not added either CVE to KEV, and no confirmed successful compromise has been publicly documented. The status may change, but your next step does not: patch PHP, restart it and check your logs back to 17 October. If you want help doing that safely, our emergency PHP patching team can work with your host or server. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions