Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
// summary
PHP developers released fixes for two critical vulnerabilities, and attacks are continuing, though no confirmed compromises have been reported so far.
// from the source
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit's complexity considering Wordf