OTX Threat: PHP2Shell: Exploitation Attempts and Remediation Trends

Wiz Research has been monitoring exploitation attempts targeting two critical PHP vulnerabilities since their public disclosure on October 21, 2026. While no successful attacks have been observed in their telemetry, some private exploits have been shared that work against various targets. Telemetry shows a 67% decrease in exposed vulnerable machines and a 47.9% reduction in significantly affected CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-111497