Wiz Reports No Successful Exploitation of PHP2Shell Flaws So Far

Wiz Research reported on 27 October that none of the exploitation attempts against the PHP2Shell vulnerabilities have succeeded so far. The follow-up analysis, titled "PHP2Shell: Exploitation Attempts and Remediation Trends," comes after PHP's 21 October emergency releases fixed CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution. Reuters reported earlier that attempts surged after disclosure.