Overview
Exploitation attempts against the PHP2Shell vulnerabilities continue, but the picture has shifted. Palo Alto Networks Unit 42 retracted its earlier assessment that post-compromise activity against a European government agency involved PHP2Shell, while a separate report points to suspected North Korean scanning of PHP infrastructure.
The Vulnerabilities
- CVE-2026-109618 and CVE-2026-109619 are critical flaws that can lead to remote code execution in default PHP configurations
- Cloudflare reported millions of exploitation attempts after public disclosure
- The PHP Foundation also warned of a third RCE flaw, CVE-2026-115560, which requires an unusual mix of configuration and application code. It will be fixed in the regular release cycle
Unit 42 Retraction
Unit 42 had reported an intrusion at a European government agency in which attackers obtained password hashes and MFA secrets within two hours and attempted Domain Admin escalation. It has now withdrawn the claim that PHP2Shell was the initial access route, saying it cannot confirm that link. The post-compromise activity itself is not in dispute.
Suspected DPRK Scanning
CYFIRMA reports a suspected North Korean campaign probing global PHP infrastructure from 21 compromised nodes, with a target set of 216 unpatched or partially mitigated hosts across many countries and sectors. Attribution is to an operator linked to the Lazarus Group ecosystem, with moderate confidence. The scanning is deliberately low-volume, so threshold-based alerting may miss it. Separately, Defused Cyber observed probes against Palo Alto GlobalProtect honeypots.
Detection and Mitigation
- ReliaQuest reproduced CVE-2026-109618 and identified log artifacts: a POST returning HTTP 500, PHP reporting memory exhaustion, and an Apache worker crash
- Xint released a scanner to check whether hosts are exposed
- Bitsight counts nearly 37 million internet-facing PHP systems and warns that a WAF or plugin update will not close the gap. Only updating PHP on the host itself does
Takeaway
Patch the PHP runtime itself, not just applications, and hunt for the crash-and-500 pattern in web logs. Treat the Unit 42 retraction as a reminder to separate confirmed initial access from assumptions.