No Successful Exploitation of PHP2Shell Flaws So Far, Wiz Reports

Wiz Research reported on 27 October that none of the exploitation attempts against PHP2Shell have succeeded so far. Its follow-up, "PHP2Shell: Exploitation Attempts and Remediation Trends," follows PHP's 21 October emergency releases, which fixed CVE-2026-109618 and CVE-2026-109619, flaws that could let attackers run code on a server without logging in. Reuters reported that attempts surged after disclosure.