PHP2Shell Exploitation Remains Unreliable as EOL Hosts Stay Exposed

Oct 29, 2026 · Original article ↗

Summary

BitSight says PHP2Shell scanning is widespread but reliable exploitation remains rare. Its analysis found 33.5% of scanned vulnerable hosts patched within a week, versus 6.4% on end-of-life branches, leaving about 11 million hosts without an upstream fix.

Key points

The flaws CVE-2026-109618 and CVE-2026-109619 combine out-of-memory corruption with stale global state to enable remote code execution; exploitation depends on matching the target’s PHP build and reaching the same worker.
BitSight observed noisy PHP scanning and one chain-shaped sequence; most observed traffic lacked the structure needed for exploitation. The article says honeypots confirmed exploitation, but reports no verified mass-compromise claim.
Before the fix, BitSight measured 29.2 million PHP hosts, including 18.4 million advertising a vulnerable version; it estimates about 11 million vulnerable hosts run end-of-life branches.
Among scanned hosts with a known vulnerable version, 33.5% were patched within a week. The rate averaged 68.6% on supported PHP 8.2–8.5 branches but was 6.4% on end-of-life branches.
Predictable, unpatched environments—including frozen legacy stacks, shared hosting, network appliances, and embedded devices—may be easier targets, according to the analysis.
The article advises updating supported PHP branches, upgrading or removing end-of-life systems from the internet, checking appliance vendor advisories, and avoiding internet-exposed management interfaces.

Article Details

Publisher: Bit Sight
Report Period: 2026-10
Scope: PHP2Shell exposure, observed scanning and exploitation, and patching trends.
Sample Size: 29.2 million measured PHP hosts; 9.47 million hosts with a known vulnerable version were rescanned after the patch release.
Key Statistics: 18.4 million of 29.2 million measured PHP hosts (63.1%) disclosed a vulnerable version; hosts without version information were excluded from this count.
About 11 million hosts, or 59.5% of the exposed population, ran an end-of-life branch.
Of 9.47 million previously vulnerable hosts rescanned, 33.5% ran a patched build; on supported branches 8.2–8.5, the average was 68.6% of 4.13 million hosts within a week, compared with 6.4% of 5.34 million hosts on end-of-life branches.
The expanded scanning analysis identified 1,035 PHP-fetching addresses across 25 clusters; the report describes only one chain-shaped sequence.
The report found no verified mass-compromise claim.
Recommendations: Update supported PHP branches to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install the distribution's fixed package.
For PHP 8.1 and older, upgrade to a supported branch, rely on a vendor that backports security fixes, or take the host off the internet.
Check vendor advisories for appliances and embedded devices, and do not expose management interfaces to the internet.

Indicators of compromise

Type	Indicator	Context
IPV4	`94[.]154[.]43[.]163`	Source of the only apparent PHP2Shell exploit-shaped sequence described in the report; it also sent Realtek command-injection datagrams directing targets to fetch malware.