Last week, the Wiz Research team reported two major PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) and has monitored exploitation attempts since public disclosure on October 21, 2026. Wiz telemetry shows a 67% decrease in distinct Internet-exposed vulnerable machines. Among remaining vulnerable systems, the proportion running PHP 7.3 or earlier dropped from 8.3% to 5.7% over five days. Affected organizations with exposed instances fell by approximately 47.9%. One week after disclosure, less than 53% of initially affected organizations remain vulnerable. Observed exploitation attempts include PHP2Shell exploit mechanisms and branded tools using session poisoning and local file inclusion. Two open-source exploit kits were tested; the older variant failed due to request-size limits, while the newer variant exhausted PHP memory but failed to obtain necessary memory addresses. Despite these efforts, no publicly available proof-of-concept demonstrates complete end-to-end exploitation against arbitrary targets. Videos of successful exploitations are available at php2shell.com. Organizations have reduced exposure through patching, upgrading, retiring machines, and restricting internet access.
PHP is used by 65% of organizations in the dataset. Wiz continues monitoring developments and will update findings as new evidence emerges. While exploitation attempts exist, the overall trend indicates successful collective remediation efforts reducing the attack surface significantly in the days following disclosure.
Source: Hacker News · Summarized by HeadlinesBriefing