PHP2Shell was attacked four days before its patch existed — and a week later most exposed PHP still runs an affected version

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution bugs in the PHP runtime, rated 9.2 Critical on CVSS v4.0 and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. This report synthesizes 70 evidence rows from 37 independent hosts — a 15-row research synthesis, 36 dated timeline observations, and 19 quantitative measurements — current through 30 October 2026. It is defensive: no exploit payloads, no proof-of-concept code, no blocklists.

Ten days of incident, by evidence level

13 distinct events, deduplicated from 36 reported observations; colour is evidence level, not severity. First-party AWS and official PHP records are preferred where several outlets describe the same event. Hover any mark for the full account and source.

Exposure estimates measure different populations — never add them

Log scale, in hosts/services/systems: a linear axis would hide the smaller counts. Each bar names its exact metric and denominator. A version banner or inferred PHP environment does not prove a host is exploitable; these are complementary exposure indicators, not counts of exploitable servers.

The evidence ladder: four different measures, never a funnel

Each step comes from a different sensor population, so these numbers imply no conversion rate between steps.

Telemetry contrast: zero in one dataset does not refute exploitation seen elsewhere

Positive and zero observations by sensor and date. Each sensor watches a different population at a different moment — Huntress, Bitdefender, Canada’s Cyber Centre and Tenable reported point-in-time zeros while honeypot operators logged attempts and successes. Hover a mark for scope and caveat.

Remediation pressure: two panels, two different units

A percentage and a count, deliberately kept apart — they share no denominator.

Why it matters: PHP’s ecosystem reach

W3Techs: PHP is the server-side language of 69.4% of all websites whose server-side programming language is known. This is PHP adoption — not PHP2Shell exposure, and not compromise — w3techs.com.

Defensive priorities, ranked

Updating the runtime and replacing every serving worker is the only complete response; configuration mitigations are temporary and incomplete, per the PHP project.

Findings the charts cannot say alone

Evidence table

All 70 rows across the three result sets. Filter by evidence level, kind, or date.

Method: defensive research synthesis on PHP2Shell (CVE-2026-109618 / CVE-2026-109619), current through 30 October 2026. 70 evidence rows from 37 independent hosts: 15 synthesis rows, 36 dated timeline observations (deduplicated to 13 events in the timeline, preferring first-party AWS and official PHP records), and 19 quantitative rows whose units and denominators differ — exposure counts use a log axis and are never summed. Values measure what each row’s own source states; zeros are point-in-time sensor snapshots. Omitted for space: duplicate third-party retellings of the same events. No exploit code, offensive procedure, or IP blocklist is included.