GoKawiilWiz Research tracks remediation and limited exploitation of PHP2Shell flaws (CVE-2026-109618/9)
Wiz Research is monitoring activity related to two PHP vulnerabilities disclosed on October 21, 2026, dubbed PHP2Shell. The firm says it has seen only limited exploitation attempts in its telemetry and no public proof-of-concept for complete end-to-end attacks, though some partners have privately shared working exploits. Wiz reports internet-exposed vulnerable machines dropped about 67% in days following disclosure, and affected organizations fell roughly 47.9%.
GoKawiil's interpretation of the reporting above, not reported fact.
The sharp drop in exposure suggests many organizations moved quickly to patch after disclosure, which could blunt the impact of any exploit code that later becomes public. However, Wiz's acknowledgment that partners possess working exploits implies the real-world risk may be higher than public telemetry alone indicates, and the situation could shift as more details emerge.
- Wiz observed a 67% drop in exposed vulnerable machines within days of disclosure
- No fully public end-to-end exploit exists yet, but private working exploits have been shared with Wiz
- Affected organizations fell about 47.9%, though PHP remains used by 65% of organizations in Wiz's dataset
Source: wiz.io, 2026-10-27
Published there as: “PHP2Shell: Exploitation attempts and remediation trends”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.