Most PHP servers remain exposed to critical PHP2Shell exploits despite warnings

Five days after the public disclosure of two critical PHP vulnerabilities known as PHP2Shell, security firms report that the vast majority of internet-facing systems remain unpatched and actively targeted by attackers. Despite urgent warnings from government agencies and major technology providers, remediation efforts have lagged significantly behind the speed of exploitation attempts.

What happened

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a Common Vulnerability Scoring System (CVSS) score of 9.2, indicating a severe risk of remote code execution. Since PHP powers approximately 70% of websites with identifiable server-side languages, including many WordPress installations, the potential impact is massive. However, data from Ox Security reveals that as of October 26, 93.6% of systems were still exposed to these flaws. Moshe Siman Tov Bustan of Ox Security noted that while panic spread through headlines, actual patching barely crawled, leaving critical assets unprotected just as proof-of-concept exploits appeared in the wild.

Independent scans by other security firms corroborate this slow response. Censys reported that while 11.2 million PHP services appeared patched, 32.5 million still advertised unsafe versions. A significant complication is that 58% of detected PHP services, totaling over 61 million, did not reveal their version numbers, many of which are likely running unsupported software. Flare found that nearly three-quarters of the 2.2 million PHP records it tracked were on branches no longer supported by the PHP project. Similarly, Mallory identified about 1.9 million internet-facing services, or 73.5% of its sample, running unsupported PHP versions that receive no official patches.

Key details

• Ox Security reports that 93.6% of systems remained exposed to PHP2Shell vulnerabilities five days after disclosure.
• The vulnerabilities CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2 and allow remote code execution.
• Censys data shows 32.5 million PHP services reporting unsafe versions, while 61.3 million services hide their version information.
• Flare and Mallory studies indicate that roughly 73-75% of tracked PHP services run on unsupported branches without official fixes.
• Cloudflare observed exploit attempts jump from thousands to millions within hours of the public announcement.
• The US Cybersecurity and Infrastructure Security Agency (CISA) mandated remediation for federal agencies by October 29, 2026.

Background

PHP2Shell refers to a pair of critical flaws that allow attackers to execute arbitrary code on servers running vulnerable PHP versions. When a vulnerability is disclosed, the standard response is to apply a security patch provided by the software maintainer. For supported PHP versions, this is often a straightforward update. However, a large portion of the internet runs on older, end-of-life PHP versions that no longer receive security updates from the PHP project. In these cases, administrators cannot simply patch the software; they must upgrade the entire PHP environment, which often requires testing applications for compatibility and working with vendors to ensure stability. This complexity significantly slows down remediation efforts compared to simple patching.

Why it matters

For teams managing self-hosted infrastructure, the prevalence of unsupported PHP versions presents a severe operational risk. If your servers are running an outdated PHP branch, you cannot rely on a simple package update to fix CVE-2026-109618 or CVE-2026-109619. Instead, you face a complex migration project that may break existing applications. The delay in patching means that attackers have a wide window to compromise systems before defenses are raised. As Cloudflare CEO Matthew Prince observed, exploit attempts escalated from thousands to millions within hours of the announcement, indicating that automated bots are already scanning for vulnerable targets.

The situation is further complicated by the fact that many organizations are unaware they are running unsupported software. With 58% of PHP services not disclosing their version numbers, it is difficult to assess the true scale of exposure. Government mandates, such as the CISA deadline for US federal agencies, highlight the severity of the threat, but private sector entities must proactively manage their own risk. Failure to act could result in data breaches, service disruptions, or complete system takeover, as evidenced by confirmed remote code execution attempts recorded by security researchers.

What you can do

• Audit your server inventory immediately to identify all instances running PHP, noting specifically which version and branch each instance uses.
• Prioritize upgrading any systems running unsupported PHP versions to a currently supported release, even if this requires application refactoring.
• Apply official security patches to all systems running supported PHP versions to address CVE-2026-109618 and CVE-2026-109619.
• Implement web application firewalls or intrusion detection systems to block known exploit patterns associated with PHP2Shell.
• Consider taking non-critical or highly vulnerable systems offline temporarily if immediate patching or upgrading is not feasible.
• Monitor logs for signs of remote code execution attempts, such as unusual process spawns or unexpected network connections from web server processes.