Wiz Says No Attacks on PHP2Shell Flaws Have Worked So Far

Wiz reported on 27 October that no attempts to exploit the PHP2Shell flaws have succeeded so far. In a follow-up report, Wiz noted that PHP, a web programming language, shipped emergency fixes on 21 October for two flaws, CVE-2026-109618 and CVE-2026-109619, which could let strangers run their own code on a server without a password. Reuters reported attempts surged after disclosure.