Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits

The two PHP vulnerabilities dominating headlines this week have left experts with a mixed bag of data to track.

Multiple large companies have reported an explosion in attempted exploitation. But dozens of experts told Recorded Future News that none of the attempts have been successful and argued that most of the available proof-of-concept (PoC) exploits only work in ideal lab conditions — making mass exploitation unlikely as of Friday. 

Experts at Amazon drew headlines on Thursday with a report that they saw evidence of exploitation attempts dating back to October 17, days before news broke of CVE-2026-109618 and CVE-2026-109619 — now known colloquially as PHP2Shell.  

Sophos reported and then retracted a report of successful exploitation, writing on Thursday evening that it was only seeing a “small number of failed exploitation attempts.” 

Google’s John Hultquist said his team has not validated exploitation in the wild and have no evidence of successful wide-scale exploitation, but he noted that “exploitation may have already begun in a limited fashion and the threat is viable and very serious.”

Arctic Wolf said exploitation attempts it observed were linked to the Potassium botnet, while researchers at Cobalt saw attempts tied to a Mirai botnet. Other experts similarly reported exploitation attempts that sought to infect devices with malware and turn them into bots as part of a distributed denial-of-service (DDoS) network. 

Spencer McIntyre, director of exploit development at VulnCheck, said the company also has seen firsthand exploit attempts but noted that many involve PoCs that are “garbage and nonfunctional.” 

The current PoCs floating around social media only work in developer and researcher environments or on production apps that do not represent how PHP is typically configured in real life, he said. 

Several incident responders said those attempting to exploit the bugs are being hung up by address space layout randomization (ASLR), a protection McIntyre said was designed to make memory corruption bugs harder to exploit. 

“There's a significant difference between demonstrating a vulnerability and developing an exploit that can overcome the security protections found in real-world environments,” he said.

McIntyre noted that his team has developed a novel technique to bypass ASLR but they have not identified another public or commercial exploit that does the same. 

“Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome,” McIntyre added. 

McIntyre and other experts warned that ASLR is not a permanent barrier to exploitation of the bugs and urged organizations to patch any vulnerable systems. 

What ‘exploitation’ means

Marcus Hutchins, a noted cybersecurity expert at Expel, said the difficulty of developing a reliable exploit may buy defenders a bit of time but it is impossible to predict how long it will take threat actors to come up with something viable. 

In several social media posts and in comments to Recorded Future News, he argued there are two separate theories as to what companies mean when they are reporting “exploitation.”

Some are reporting sophisticated, likely state-sponsored, threat actors doing targeted exploitation while others are simply cataloging attempted mass exploitation using lab-focused PoCs that do not work. 

“The second case matches the evidence I've personally seen,” Hutchins said. 

While ASLR is not a “significant barrier” to successful exploitation, it does hinder attempts at mass exploitation, he added. 

“Currently there are no reports that I've seen of [successful] mass exploitation, nor have I seen any mass exploitation myself. However, someone has built a scanner which can remotely identify vulnerable systems, so there are a bunch of internet-wide scan attempts ongoing,” Hutchins explained. “This means that should a fully-weaponized exploit become available, it's likely that several threat actors already have target lists containing publicly reachable unpatched systems ready to go.”

Censys created a PHP2Shell dashboard that says as of October 22, there are more than 41 million Internet-facing PHP services on affected versions and about 1 million operating with a fixed release. 

Cobalt CISO Andrew Obadiaru said the lack of confirmed compromises shows how hard PHP2Shell is to weaponize but argued that the difficulty won’t last, highlighting VulnCheck’s reported exploit. 

“Attackers are refining their tooling in the open, so defenders should treat this quiet period as borrowed time,” he said, warning that attackers are fingerprinting servers to find the exact configurations their exploit needs. 

“Once a working technique moves from specialist tooling into botnet playbooks, defenders will have days, not weeks, to catch up.”