PHP2Shell probes pass 74,000 with no confirmed breach
PHP2Shell attacks have produced more than 74,000 exploit or reconnaissance attempts, according to Wordfence, although the company has not confirmed that any website was compromised through the two underlying PHP vulnerabilities. The PHP project issued emergency updates on October 21, 2026, for the critical flaws CVE-2026-109618 and CVE-2026-109619. Wordfence bases its assessment on telemetry from more than 5,000,000 protected WordPress websites and says it is expanding its monitoring. The required remediation is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package explicitly confirmed to include both fixes. Administrators must then restart every PHP worker, which is a process that handles website requests. Updating WordPress does not update the separate PHP software running behind it.
One large attack cluster sent multipart/form-data requests, a web format that divides an upload into multiple named sections. The requests included a session identifier, the PHP_SESSION_UPLOAD_PROGRESS feature and repeated fields named t[0] through at least t[136]. Wordfence omitted 134 of those fields when publishing its example. Their repeated data appeared designed to put pressure on memory and influence how PHP allocated the request. Embedded strings included the command-execution marker P2S_OK, the system function name and commands intended to print server details and read the first 200 bytes of .env, ../.env, ../../.env and wp-config.php. These files can hold environment variables, meaning configuration values supplied to an application, as well as database credentials and other secrets. The request demonstrates intent, but by itself cannot show that memory was corrupted or that a command ran successfully.
Wordfence also examined 10,000 events collected from October 20 through October 22. The sample was deliberately selected around requests mentioning PHP_SESSION_UPLOAD_PROGRESS, so it is not representative of all malicious web traffic. It contained 3,752 apparent PHP2Shell memory-pressure or state-corruption attempts aimed at command execution and configuration theft. Another 1,139 used Laravel serialized-object gadget chains, sequences that try to misuse classes already installed in an application to run a shell command. A further 2,534 tried serialized objects associated with Monolog, Symfony, Guzzle, WordPress, ThinkPHP and other classes. These categories describe payload characteristics and can overlap.
The same sample included 512 NxSP session-file poisoning attempts. Those try to place malicious content in a temporary session file and combine it with a separate local-file-inclusion flaw, which is a weakness that lets an application load a local file it should not expose. Thirty requests contained out-of-band PHP upload canaries, tests that wait for a separate internet callback to show whether another upload or execution method worked. Wordfence cautions that the NxSP and canary traffic uses the same multipart or upload-progress area but depends on separate vulnerabilities or application behavior. It therefore should not be treated as confirmed exploitation of either new CVE. The dataset contains requests rather than responses or direct evidence from targeted servers, so every count measures attempts, not successful intrusions.
Across the observed payloads, attackers tried to confirm execution with P2S_OK, NxSP followed by digits, and SHL_OK. Commands such as id, uname -a and hostname would profile a server. Other actions sought secrets in environment variables, .env and wp-config.php, searched common content-management-system directories, and attempted to create persistent command files named wp2s.php in writable upload, plugin or theme locations. Some requests tried to download and execute another payload with curl, wget and a shell interpreter. Others used unique hostnames under oast.pro, oast.fun and oast.online for an out-of-band callback, which is a connection from the targeted server to an external service. Additional defensive indicators include ADV618BOUNDARY, ----P2SB, php2shell.php, axiom_*.php and the class names Illuminate\Broadcasting\PendingBroadcast, Monolog\Handler\BufferHandler and Requests_Utility_FilteredIterator.
The 20 busiest source addresses were 87.121.84.174 with 8,525 blocked attempts, 181.215.186.252 with 7,856, 185.196.220.132 with 7,146, 185.161.210.29 with 5,796, 152.233.51.69 with 5,317, 45.134.225.16 with 3,623, 107.189.14.87 with 2,365, 193.47.62.24 with 2,263, 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b with 1,953, and 103.147.220.17 with 1,860. The remaining addresses were 143.246.223.124 with 1,791, 52.74.54.75 with 1,260, 65.49.200.56 with 836, 193.142.147.111 with 775, 85.137.56.188 with 672, 85.137.53.26 with 664, 167.254.242.130 with 648, 217.112.152.168 with 619, 203.78.119.133 with 616 and 140.245.32.169 with 616.
Whether exploitation works remains sensitive to PHP configuration, the Server Application Programming Interface (SAPI) connecting PHP to the web server, installed extensions, available application classes and the current state of a worker. Wordfence previously achieved code execution while testing CVE-2026-109619 in a specially configured Apache laboratory using PHP 8.5.11. The same proof of concept crashed a normally optimized PHP 8.5.11 build instead, while PHP 8.5.12 remained healthy. For CVE-2026-109618, its testing reproduced different behavior between vulnerable and fixed releases but did not independently achieve code execution. The newly analysed production traffic does not alter those laboratory findings or prove a successful real-world exploit.
Confirming a compromise would require evidence from responses, files, processes, crashed workers, Domain Name System requests or outbound web connections on the targeted server. Wordfence stresses that the absence of such confirmation in its telemetry does not make an unpatched system safe, because failures and callbacks can occur outside WordPress and its logs. Site operators who suspect compromise should retain relevant evidence; Wordfence also invited submissions to samples@wordfence.com. Wordfence Care and Wordfence Response customers can contact its incident response team, and the company states that Response has 24/7/365 availability with a one-hour response time. For site owners considering how the hosting layer fits into their protection, AEU Hosting provides managed WordPress hosting secured end to end. Regardless of hosting arrangement, the immediate task is to verify the PHP service behind every website, install a release containing both fixes and restart its workers.