PHP2Shell: Exploitation Attempts and Remediation Trends

The article details ongoing exploitation attempts against the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Wiz Research observed multiple attack variants using different exploit kits, primarily targeting memory exhaustion and session poisoning, though no complete end-to-end exploitation was confirmed in their telemetry. Attackers used techniques such as sending oversized multipart requests to trigger memory exhaustion and attempted to leak process memory, but these stages failed due to differences in PHP configurations and deployment environments. The report also notes that some IP addresses successfully exploited honeypots, contributing to CISA's inclusion of PHP2Shell in its KEV catalog, while other tools labeled as PHP2Shell exploits actually relied on unrelated session poisoning and LFI techniques.

AI-extracted · verify before operational use